search

DC Sync Attack

https://spookysec.net/2019-12-01-domain-controller-sync/spookysec.netchevron-right
LogoPrivExchange : One Hop away from Domain Adminwww.c0d3xpl0it.comchevron-right

hashtag
Requirements

Within an Active Directory network, it’s useful to have a backup Domain Controller so if your primary fails, you’ll have a second one to back you up. Perhaps if your workplace gets hit on Ransomware, you may have a hot site so that you can be back up in running in a few minutes. These are all valid reasons that a user account might have a very dangerous set of account permissions called “Replicating Directory Changes”, “Replicating Directory Changes All”, and lastly, “Replicating Directory Changes in Filtered Set”. This is commonly referred to as “DC Sync”, or Domain Controller Sync.

hashtag
Attack

We will primarily be working with the impacket tool called “secretsdump.py” this time around. Access to any ordinary user account will not suffice. as described above, a user account with Replicating Directory Changes is required. This is what occurs when a user account without these privileges attempts to preform the attack.

If you’re not careful, this could trigger an Intrusion Prevention/Detection System alert.

With a proper user account this attack will likely succeed with ease.

PreviousDNS Admin to SYSTEMNextEscalating privileges with ACLs in Active Directory

Last updated