Active Directory Abuse Primitives And Operation Security

Active Directory Abuse Primitives And Operation Security

Speakers: Mars Cheng (Threat Research Manager, TXOne Networks); Dexter Chen (Threat Researcher, TXOne Networks)

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=CIkSiECswYw

Overview

This talk, presented by Mars Cheng and Dexter Chen of TXOne Networks at HITB Amsterdam, delves into advanced Active Directory (AD) abuse primitives and the critical role of Operation Security (OpSec) in successful red team engagements. Recognizing that Active Directory remains the linchpin of enterprise authentication and authorization, the speakers highlight a growing challenge: blue teams are increasingly aware of AD attack vectors and are deploying sophisticated detection and prevention mechanisms. This shift necessitates that red teams move beyond basic attack execution and integrate a robust OpSec mindset into every phase of their operations.

The core premise of the presentation is that many potent AD attack techniques exploit inherent features of the directory service, rather than traditional vulnerabilities. These "abuse primitives" are difficult to patch or prevent entirely, making detection evasion paramount for attackers. The speakers demonstrate four real-world attack paths, meticulously detailing how common AD exploitation techniques can be rendered stealthy by understanding and manipulating the indicators that blue teams typically monitor. This talk serves as a vital guide for red teams aiming to enhance their stealth and persistence, while also providing valuable insights for blue teams seeking to understand advanced adversary tradecraft.

The research presented here emphasizes that operational success for red teams in modern enterprise environments hinges on a deep understanding of target security postures, identifying potential detection indicators, and aligning attack behaviors with the environmental baseline to appear as legitimate activity. By showcasing practical evasion techniques for well-known AD attacks, Cheng and Chen underscore the continuous cat-and-mouse game between offensive and defensive security teams in the context of Active Directory security.

Background

▶ Watch: Introduction: Active Directory abuse and OpSec (0:00)

Active Directory, a directory service developed by Microsoft, is the cornerstone of identity and access management for the vast majority of enterprises, with over 97% of organizations relying on it. Its primary function has evolved from centralized management to serving as the critical asset for authentication and authorization within an enterprise environment. Key protocols underpinning AD include LDAP (Lightweight Directory Access Protocol), Kerberos (Microsoft's implementation of the network authentication protocol), and DNS (Domain Name System). AD also integrates with various services like Single Sign-On (SSO) and Active Directory Federation Services (ADFS).

The pervasive reliance on Active Directory makes it a prime target for adversaries. However, as red team techniques become more sophisticated, blue teams have simultaneously advanced their detection and prevention capabilities. They are actively building mechanisms to identify and thwart AD-based attacks. This evolving defensive landscape creates a significant challenge for red teams: how to compromise AD environments without triggering alarms. This is where the concept of Operation Security (OpSec) becomes indispensable.

In the context of AD exploitation, OpSec is defined as the process of identifying friendly actions that could be observed by enemy intelligence (the blue team) and then taking measures to prevent such observations from compromising the operation. For Active Directory, the speakers outline a three-step OpSec approach:

1. Enumerate Security Posture: Understand the target domain's configuration, policies, and existing security controls.
2. Identify Possible Detection Indicators: For any chosen attack primitive or technique, determine what artifacts, logs, or network patterns the blue team might monitor.
3. Align Indicators with Baseline: Modify attack behaviors to match normal, baseline activity within the environment, making them indistinguishable from legitimate user actions. The goal is to avoid detection by appearing "normal."

This talk focuses on how to apply this OpSec methodology to various AD abuse primitives, transforming potentially noisy attacks into stealthy operations.

Key Findings

▶ Watch: Demo 1: Kerberoasting to Group Policy abuse (10:45)

The central finding of this research is that many powerful Active Directory attack techniques are not based on traditional vulnerabilities but rather on abusing inherent features or primitives of the AD architecture. Unlike vulnerabilities, which can often be patched, these features are fundamental to AD's operation, making them exceptionally difficult to prevent or eliminate. This inherent nature means that the focus for both attackers and defenders shifts from prevention to detection and evasion.

The speakers demonstrated four distinct, real-world attack paths, each illustrating how attackers can chain multiple AD abuse primitives while incorporating OpSec principles to evade detection:

1. Kerberoasting to Group Policy Abuse: This path showcased how to extract service account credentials, leverage them for lateral movement, escalate privileges via DNS Admin abuse, and ultimately deploy ransomware using Group Policy Objects (GPOs), all while attempting to minimize forensic footprint.
2. Certificate Template Abuse to Cross-Forest Compromise: This complex chain involved abusing misconfigured certificate templates to impersonate privileged users, leveraging unconstrained delegation and the printer bug to obtain tickets, and performing DC Sync to compromise a foreign domain across a forest trust.
3. Password Spray to ADFS Golden SAML: This path began with a stealthy password spray to gain initial access, followed by ACL abuse to configure shadow credentials, extracting password hashes, forging silver tickets, compromising an ADFS server, and finally creating a Golden SAML token for arbitrary user impersonation.
4. Printer Bug to Shadow Credential & Cross-Forest Diamond Ticket: The final path combined the printer bug with NTLM relay and shadow credentials to gain initial foothold, then performed DC Sync to obtain the krbtgt hash, and ultimately forged a Diamond Ticket (a combination of Golden Ticket and SID History injection) to achieve cross-forest domain administrator privileges.

Across all these demonstrations, the overarching key finding was the paramount importance of Operation Security. For red teams, understanding the specific detection indicators for each technique and actively working to align attack traffic and artifacts with the target environment's baseline behavior is critical for operational success. For blue teams, these demonstrations highlight the need to move beyond signature-based detection and focus on behavioral analytics, understanding legitimate AD baselines, and monitoring for subtle deviations that might indicate an OpSec-aware adversary. The research reinforces that the "cat-and-mouse" game in Active Directory security is increasingly played at the level of behavioral anomaly detection and sophisticated evasion.

Technical Deep Dive

▶ Watch: OpSec considerations for certificate template abuse (32:00)

The talk provides a comprehensive technical deep dive into several advanced Active Directory abuse primitives and their associated OpSec considerations. Each attack path meticulously chains multiple techniques, emphasizing how seemingly disparate methods can be combined for maximum impact.

Attack Path 1: Kerberoasting to Group Policy Abuse

This path begins with Kerberoasting, a technique to obtain service account credentials. When a service (like MS SQL) is registered with a Service Principal Name (SPN), Kerberos tickets for that service are encrypted with the service account's NTLM hash. Attackers can request these service tickets and then offline brute-force the encryption to recover the plaintext password. The speakers demonstrated using Rubeus to identify SPNs and John the Ripper to crack the hashes.

Once service account credentials are obtained, Pass the Ticket (PtT) is used. This involves taking a stolen or forged Kerberos ticket (specifically a Ticket Granting Ticket (TGT)) and injecting it into the current logon session to authenticate as the target user without knowing their plaintext password. This allows lateral movement to systems where the service account has privileges.

The next critical step involves DNS Admin Abuse. If the compromised user (e.g., Alicia in the demo) is a member of the DNSAdmins group, they can manipulate the DNS server. Specifically, attackers can configure a server level plugin DLL by writing to a specific registry key (HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll). Upon restarting the DNS service, the specified DLL is loaded and executed with SYSTEM privileges, effectively granting domain controller access.

Finally, with domain controller access, Group Policy Abuse is leveraged. Attackers can create or modify existing Group Policy Objects (GPOs) to deploy arbitrary payloads across the entire domain. In the demo, this was used to deploy ransomware by configuring a GPO to execute a malicious task on all domain-joined machines.

Attack Path 2: Certificate Template Abuse to Cross-Forest Compromise

This path exploits misconfigurations in Active Directory Certificate Services (AD CS). Certificate Template Abuse allows an attacker to enroll a certificate impersonating a privileged user. Vulnerable settings include:

• Enroll we supply subject flag: Allows the requestor to specify any user in the certificate's subject alternative name.
• Excessive enrollment permissions: Allows authenticated users to enroll certificates for a template.
• Add attribute subject alt name 2: A flag on the Certificate Authority (CA) itself, similar to the first flag.

Once a certificate is obtained for a privileged user (e.g., Domain Administrator), it can be used for PKINIT (Public Key Cryptography for Initial Authentication in Kerberos). This allows Kerberos authentication using a certificate's private key instead of a password hash to obtain a TGT. Rubeus was shown to facilitate this file-less attack by encoding the PFX certificate in Base64.

With a TGT for a domain administrator, the attacker can move to a domain controller. On the DC, Unconstrained Delegation Abuse is combined with the Printer Bug. The Printer Bug (CVE-2021-34527 or similar, also known as PrintNightmare-related issues, or more generally, PetitPotam if NTLM relay is involved) can force a domain controller to authenticate to an attacker-controlled machine. If the DC has unconstrained delegation enabled, any TGTs received by that DC (including the DC's own TGT from the forced authentication) can be dumped from memory. This allows the attacker to obtain the DC's TGT.

Finally, with the DC's TGT, DC Sync can be performed. DC Sync allows an attacker to simulate domain replication by requesting the password hashes of any user, including the krbtgt account, from a domain controller. This requires specific permissions (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All), which the compromised DC's TGT provides. The demonstration showed compromising a foreign domain's DC using this method.

Attack Path 3: Password Spray to ADFS Golden SAML

This path begins with Password Spray, a stealthier alternative to traditional brute-force attacks. Instead of repeatedly trying different passwords for a single user (which often triggers account lockouts), an attacker tries a single common password against many different user accounts across the domain. The goal is to find accounts with weak, common passwords without exceeding lockout thresholds.

Upon gaining initial access to an account, ACL Abuse is performed. Active Directory objects (users, groups, computers) have Access Control Lists (ACLs) that define permissions. Attackers can exploit misconfigured ACLs, such as having ForceChangePassword rights on a user object or Full Control over a domain group. In the demo, the compromised account had full control over the ADFS server object. This ACL right was then used to configure Shadow Credentials.

Shadow Credential is an ACL abuse implementation where an attacker, with sufficient ACL rights (e.g., GenericWrite or WriteProperty on msDS-KeyCredentialLink), configures a certificate for domain authentication on a target account without requiring AD CS. This allows the attacker to request a TGT for the target account using their custom certificate.

After obtaining a PKINIT TGT, the attacker can perform Unpack the Hash. When a TGT is obtained via PKINIT, it often includes an RC4 password hash embedded within the ticket's PAC (Privilege Attribute Certificate) for NTLM compatibility. Attackers can decrypt this using the TGT session key to recover the RC4 hash of the target account. This RC4 hash is crucial for forging Silver Tickets.

A Silver Ticket is a forged Kerberos service ticket (ST) that grants access to a specific service on a specific server. Unlike a Golden Ticket (which requires the krbtgt hash and grants TGTs), a Silver Ticket only requires the NTLM hash of the service account running the target service. With the ADFS server's RC4 hash (obtained via Unpack the Hash), an attacker can forge a Silver Ticket to access the ADFS service with elevated privileges.

Finally, with elevated access to the ADFS server, the attacker performs ADFS Golden SAML. This involves dumping critical ADFS credentials: the KDS key (Key Distribution Service) and configuration information (issuance rules, certificate). With these, an attacker can forge a SAML token for any user, including domain administrators. This forged SAML token can then be used to authenticate to applications federated with ADFS, such as Outlook, effectively impersonating the chosen user. The demo showed intercepting an HTTP request with Burp Suite to replace a legitimate SAML token with a forged one.

Attack Path 4: Printer Bug to Shadow Credential & Cross-Forest Diamond Ticket

This path starts with leveraging the Printer Bug (e.g., PetitPotam) to force a target server (e.g., EX01) to authenticate to an attacker-controlled NTLM relay server. This authentication is then relayed (e.g., NTLM Relay from HTTP to LDAP) to configure Shadow Credentials on the EX01 computer account. This effectively gives the attacker a certificate for the EX01$ computer account.

Using this shadow credential, a PKINIT TGT is obtained for EX01$. The Unpack the Hash technique is then used to extract the NTLM hash of the EX01$ computer account. With the NTLM hash of a computer account that has sufficient privileges (e.g., an Exchange server often has Exchange Windows Permissions or similar rights), DC Sync is performed to obtain the krbtgt password hash from the domain controller.

With the krbtgt hash, the attacker can forge a Golden Ticket. A Golden Ticket is a forged TGT that grants arbitrary privileges (e.g., Domain Admin) by injecting desired SIDs into the ticket's PAC. To achieve cross-forest compromise, SID History Injection is combined with the Golden Ticket. This involves adding the SID of a privileged group from a different trusted domain (e.g., the Domain Admins SID from site B.local) into the SID History attribute of the forged Golden Ticket.

The result is a Diamond Ticket: a Golden Ticket with injected SID History, allowing the attacker to authenticate as a domain administrator in a foreign, trusted forest. The demo showcased using this Diamond Ticket to access and perform lateral movement to a DC in site B.local.

Demo / Proof of Concept

▶ Watch: Demo 3: Password spray to ADFS Golden SAML (43:30)

The talk featured four distinct video demonstrations, each illustrating a full attack chain from initial access to full domain or cross-forest compromise, with a focus on OpSec considerations.

Attack Path 1: Kerberoasting to Group Policy Abuse

The demonstration began by enumerating domain information and identifying SPNs using Rubeus. The hash for an MS SQL service account was extracted and cracked offline with John the Ripper on a Kali Linux machine. The recovered plaintext password was then used for Pass the Ticket to obtain a TGT for the MS SQL service account. This TGT was injected into a new logon session. Lateral movement was performed to an MS SQL server, where the Alicia user's TGT was dumped. Alicia was found to be a member of the DNSAdmins group. Leveraging PSExec for lateral movement to the MS SQL server, the attacker then performed DNS Admin Abuse by configuring the ServerLevelPluginDll registry key to execute a payload (which promoted the Mars user to Domain Admin). After restarting the DNS service, the registry key was cleaned up. Finally, with Domain Admin privileges, a malicious Group Policy Object was created to deploy sample ransomware to the entire domain, demonstrating the ultimate impact.

Attack Path 2: Certificate Template Abuse to Cross-Forest Compromise

This demo started with certutil to confirm AD CS installation and Rubeus to enumerate vulnerable certificate templates. A template was identified with enroll we supply subject and open enrollment rights. A certificate was enrolled, specifying a Domain Administrator in the subject alternative name. This certificate was then converted to PFX, Base64 encoded, and used with Rubeus for PKINIT to obtain a Domain Admin TGT. PSExec was used to gain a beacon on a Domain Controller. On the DC, forest trusts were enumerated, revealing a bidirectional trust. The Printer Bug was then triggered against a foreign DC, and combined with Unconstrained Delegation Abuse on the local DC, the foreign DC's TGT was dumped. This TGT allowed DC Sync to obtain the foreign domain's administrator hash, which was then used to forge a TGT and PSExec to the foreign DC, achieving cross-forest compromise.

Attack Path 3: Password Spray to ADFS Golden SAML

The demonstration began by enumerating domain and password policy information. A password spray attack was performed, successfully finding a valid credential for one user. This user's TGT was obtained via Rubeus. Further enumeration revealed this user had Full Control over the ADFS server object through an inherited domain group. This ACL abuse was leveraged to configure a Shadow Credential for the ADFS server account by setting the msDS-KeyCredentialLink attribute. A PKINIT TGT for the ADFS server account was then requested, and the Unpack the Hash technique was used to extract its NTLM hash. This hash was used to forge a Silver Ticket to access the ADFS computer system. Lateral movement to the ADFS server via PSExec allowed dumping of ADFS credentials (KDS key, issuance rules, certificate). These credentials were used to forge a Golden SAML token for the Administrator account. Finally, a legitimate ADFS login request was intercepted with Burp Suite, and the original SAML token was replaced with the forged one, successfully logging into Outlook as the Domain Administrator.

Attack Path 4: Printer Bug to Shadow Credential & Cross-Forest Diamond Ticket

This demo started by enumerating named pipes for SMB IPC and checking for running services like Printer Principal and WebDAV client. An NTLM server was hosted. The Printer Bug was then triggered against EX01$ (an Exchange server computer account) to force authentication to the NTLM relay server, which was then used to configure Shadow Credentials on EX01$. A PKINIT TGT for EX01$ was obtained, and Unpack the Hash was used to dump its NTLM hash. This hash was then used to perform DC Sync and retrieve the krbtgt password hash. With the krbtgt hash, a single Rubeus command was used to forge a Golden Ticket with Domain Admin privileges and inject the site B.local Domain Admin SID into its SID History, creating a Diamond Ticket. This ticket was then used to access DC01.site B.local, demonstrating cross-forest Domain Admin access and lateral movement via PSExec.

Defensive Implications

▶ Watch: Key Takeaways: Primitive abuse and OpSec importance (58:00)

The detailed OpSec techniques presented in this talk offer crucial insights for blue teams to enhance their detection capabilities and for red teams to refine their evasion strategies.

Kerberoasting

• Detection: Blue teams often monitor for wild LDAP queries (Event ID 4662) to find SPNs, Event ID 4769 (TGT request) with unusual Ticket Options (e.g., 0x40810000 from Rubeus vs. default 0x30000000), and RC4 encryption type (0x17) in service tickets.
• OpSec/Evasion: Instead of wild LDAP queries, perform a generic query for all users and then filter for SPNs locally. To evade Ticket Options detection, use tools like TrustSec or modify Rubeus to align with the default 0x30000000. For encryption, use AES256 instead of RC4 (though harder to brute force, it's less suspicious).

Pass the Ticket

• Detection: AS-REQ without pre-authentication followed by one with pre-authentication is normal Windows behavior. Tools like Rubeus often send AS-REQ with pre-authentication by default. Also, a single logon session having TGTs for multiple distinct users (e.g., Mars and MS SQL Service) is highly suspicious.
• OpSec/Evasion: Modify Rubeus (e.g., add a stack handle) to mimic the two-step AS-REQ process (first without, then with pre-authentication). For the multiple TGTs in one session, no direct bypass was presented; the advice is to clean up footprints as soon as possible after the operation.

Dump Ticket

• Detection: Monitoring RegisterLogonProcess calls, especially those with specific strings like 3 S found in Rubeus's code.
• OpSec/Evasion: Modify Rubeus to remove such unique string indicators.

DNS Admin Abuse

• Detection: The presence of a ServerLevelPluginDll registry key (HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll) being populated is a strong indicator.
• OpSec/Evasion: Remove the registry key immediately after payload execution. Alternatively, if already a member of DNSAdmins, leverage existing DNS records with appropriate permissions to achieve desired effects without populating new registry keys.

Certificate Template Abuse (PKINIT)

• Detection: Monitoring enrollment events for certificates where the subject name or subject alternative name specifies a high-privilege account (e.g., Administrator). Event ID 4769 will show certificate information when PKINIT is used.
• OpSec/Evasion: Request certificates for accounts with the minimum necessary privileges (e.g., an Exchange server group member for DC Sync, or a local admin for a specific machine), rather than directly Domain Admin. To blend in, enumerate if the target environment already uses PKINIT (e.g., smart cards); if not, PKINIT will stand out as a deviation from the baseline.

Unconstrained Delegation Abuse

• Detection: LSASS activity on a Domain Controller (a Tier 0 asset) is heavily monitored. Dumping TGTs from a DC will likely trigger alerts.
• OpSec/Evasion: Instead of abusing unconstrained delegation on a DC, configure a less critical machine (e.g., a custom-configured server without heavy monitoring) as an unconstrained delegation host and dump TGTs from there.

DC Sync

• Detection: DSGetNCChanges requests originating from machines that are not legitimate Domain Controllers or AAD Connect servers are a clear indicator.
• OpSec/Evasion: If possible, perform DC Sync from a machine that might be on a blue team's whitelist (e.g., an AAD Connect server). Alternatively, shell directly into a DC, but this carries higher risk due to the DC's Tier 0 status.

Password Spray

• Detection: High volume of logon failures or rapid account lockouts within a short period.
• OpSec/Evasion: Increase the time delay between each password attempt to lower the volume of logon failures. Monitor bad password attempt counters to stay below lockout thresholds.

Shadow Credential

• Detection: Monitoring changes to the msDS-KeyCredentialLink attribute on user or computer objects. If the environment doesn't typically use certificate-based authentication without AD CS, this attribute being populated will stand out.
• OpSec/Evasion: No direct mechanism to bypass the attribute change itself. The primary OpSec consideration is understanding the environment's baseline usage of such features.

Unpack Hash / Silver Ticket

• Detection: Forged silver tickets using RC4 encryption (0x17) will often deviate from the environment's baseline, which is typically AES256.
• OpSec/Evasion: Instead of relying on the RC4 hash from Unpack the Hash, leverage S4U2self via PKINIT to obtain a service ticket. This allows specifying the desired encryption type (e.g., AES256), aligning with the environment's baseline and evading detection.

ADFS Golden SAML

• Detection: Dumping ADFS credentials (KDS key, configuration) locally from an ADFS server (a Tier 0 asset) will trigger high-fidelity alerts.
• OpSec/Evasion: Dump the DKM key remotely using LDAP or DC Sync. Dump ADFS configuration information (issuance rules, certificate) remotely via the ADFS replication service.

Golden Ticket / SID History Injection

• Detection: Event ID 4627 showing Domain Admin in the group membership for a TGT where it shouldn't be.
• OpSec/Evasion: Leverage S4U2self and S4U2proxy to obtain service tickets without generating the specific Event ID 4627 related to group membership modification in the TGT.

Key Takeaways

• Active Directory abuse primitives are features, not vulnerabilities: Many powerful AD attacks exploit inherent functionalities of the directory service, making them difficult to patch or prevent. Detection and evasion become the primary battlegrounds.
• Operation Security (OpSec) is paramount for red team success: As blue teams improve AD detection, red teams must integrate OpSec into every step of their operations to make attack actions appear as normal, baseline behavior and avoid detection.
• Understanding environmental baselines is crucial for evasion: Attackers must enumerate the target environment's normal Kerberos ticket options, encryption types, logon behaviors, and service usage to tailor their attacks to blend in.
• Specific techniques exist to bypass common detections: Examples include performing generic LDAP queries before filtering, modifying Rubeus behavior for AS-REQ and ticket dumping, leveraging S4U2self to control encryption types for service tickets, and dumping ADFS credentials remotely.
• Cleanup and minimal privilege are essential: Eradicating forensic footprints (e.g., deleting registry keys for DNS Admin abuse) and requesting the minimum necessary privileges for certificates are vital for stealth and persistence.
• The red team-blue team dynamic in AD security is a continuous adaptation cycle: Attackers constantly refine their OpSec, forcing defenders to evolve their monitoring and behavioral analytics to identify subtle anomalies rather than relying solely on signatures.

About the Speaker(s)

Mars Cheng is a Threat Research Manager at TXOne Networks, where he leads the P73 research team. He is also an Executive Director of the Association of Hacking Taiwan, an organization that orchestrates various cybersecurity activities across Taiwan and the Asia Pacific region, including the renowned Hitcon conference. Mars's research interests span a broad range of topics, including ICS/SCADA, IoT malware analysis, and enterprise security. He is a seasoned speaker at numerous cybersecurity conferences and an active instructor in the field.

Dexter Chen is a Threat Researcher at TXOne Networks and serves as a Supervisor for the Association of Hacking Taiwan. His expertise lies in red teaming, Active Directory security, and penetration testing. Dexter is a frequent speaker at cybersecurity conferences and holds multiple industry certifications, reflecting his deep technical knowledge and practical experience in offensive security.