GoldenGMSA
Within an Active Directory environment, service accounts are often created and used by different applications. These accounts usually have a password that is rarely updated. To address this issue, it is possible to create Group Managed Service Accounts (gMSA), which are managed directly by AD, with a strong password and a regular password rotation.
The password of a gMSA account can legitimately be requested by authorized applications. In that case, an LDAP request is made to the domain controller, asking for the gMSA account's
msDS-ManagedPassword attribute's value.A gMSA account's
msDS-ManagedPassword attribute doesn't actually store the password (it's a constructed attribute). Everytime that attribute is requested by an authorized principal, the domain controller computes it and returns the result. The calculation is detailed a bit more in the password calculation part of this recipe, but simply said, it relies on a static master key (i.e. one of the KDS root keys) and some additional data relative to the gMSA account.The "GoldenGMSA" persistence lies in the fact that the KDS root keys used for gMSA password calculation don't change (at least not without some admin intervention or custom automation). Once they are exfiltrated and saved, any gMSA account password can be calculated since the additional values needed can be obtained by any low-privileged user.
Once an AD environment is compromised, acquiring the "GoldenGMSA" persistence requires to dump the KDS root keys.
Windows
UNIX-like
The KDS (Key Distribution Service) root keys can be exfiltrated from the domain with high-privileged access with GoldenGMSA (C#).
Without the
--forest argument, the forest root domain is queried, hence requiring Enterprise Admins or Domain Admins privileges in the forest root domain, or SYSTEM privileges on a forest root Domain Controller.GoldenGMSA.exe kdsinfo
With the
--forest argument specifying the target domain or forest, SYSTEM privileges are required on the corresponding domain or forest Domain Controller. In case a child domain is specified, the parent domain keys will be dumped as well.GoldenGMSA.exe kdsinfo --forest child.lab.local
At the time of writing this recipe, September 24th, 2022, no equivalent exists (not that we know of), for UNIX-like systems.
Later on, the attacker can then, with low-privileged access to the domain:
- 1.
- 2.
Windows
UNIX-like
In addition to the KDS root keys, the following information, relative to a gMSA, need to be dumped in order to compute its password:
- SID (Security IDentifier)
- RootKeyGuid: indicating what KDS root key to use
- Password ID: which rotates regularly
GoldenGMSA.exe gmsainfo
In order to dump the necessary information of a single gMSA, its SID can be used as filter with the
--sid argument.GoldenGMSA.exe gmsainfo --sid "S-1-5-21-[...]1586295871-1112"
At the time of writing this recipe, September 24th, 2022, no equivalent exists (not that we know of), for UNIX-like systems.
Windows
UNIX-like
Given a gMSA SID, the corresponding KDS root key (matching the RootKeyGuid obtained beforehand), and the Password ID, the actual plaintext password can be calculated with GoldenGMSA (C#).
GoldenGMSA.exe compute --sid "S-1-5-21-[...]1586295871-1112" --kdskey "AQA[...]jG2/M=" --pwdid "AQAAAEtEU[...]gBsAGEAYgBzAAAA"
Since the password is randomly generated and is not intended to be used by real users with a keyboard (but instead by servers, programs, scripts, etc.) the password is very long, complex and can include non-printable characters. GoldenGMSA will output the password in base64.
import base64
import hashlib
b64 = input("Password Base64: ")
print("NT hash:", hashlib.new("md4", base64.b64decode()).hexdigest())'
At the time of writing this recipe, September 24th, 2022, no equivalent exists (not that we know of), for UNIX-like systems.
The GoldenGMSA (C#) tool featured in this recipe can retrieve gMSA password without the
--kdskey or --pwdid arguments, by requesting those information. If the --kdskey is not supplied, high-privilege access will be needed by the tool, which is outside the scope of the GoldenGMSA technique explained in this recipe.
Last modified 3mo ago