DCSync

By exploiting the Directory Replication Service Remote Protocol (MS-DRSR), the attacker can request replication data from another DC, including password hashes and Kerberos keys, without directly accessing the target machine’s memory.

• DCSync Ransomware Technique: Cybersecurity Definition | Halcyon.ai
• Defending Your Directory: An Expert Guide to Securing Active Directory Against DCSync Attacks | NCC Group

Retrieving password hashes of other domains

A domain controller (DC) in a Windows environment is configured to securely validate user requests within a domain. The function of a DC is to stockpile user accounts and data, provide authentication, and append a security policy for the domain. Replicating a directory in the IT environment plays a vital role as it assists system administrators to organize and handle data flow across many DCs. For example, when an employee of an organization updates their account credentials, the updated credentials should be replicated across all the DCs, which can facilitate easy authentication for users.

The DCSync attack is a technique used by attackers on selective DCs. In this attack, an attacker initially compromises and obtains privileged account access with domain replication rights. Then, they activate replication protocols to create a virtual DC similar to the original AD. This access enables the attacker to send requests to the DC and receive the victim’s confidential information such as NTLM password hashes. Using this information, an attacker can launch further attacks such as golden ticket attacks, account manipulation, and living off the land (LOTL) attacks as well as embed ransomware in the compromised servers.

Methodology

DCSync Attack Stages

The DCSync attack is performed in a sequence of eight stages, starting from lower privileges and leading to higher privileges:

• Stage 1: Performs external Reconnaissance
• Stage 2: Compromises the targeted machine
• Stage 3: Performs internal reconnaissance
• Stage 4: Escalates local privileges
• Stage 5: Compromises credentials by sending commands to Domain Controller
• Stage 6: Performs admin-level reconnaissance
• Stage 7: Performs malicious Remote Code Execution
• Stage 8: Gains domain admin credentials

Access Rights Required

To perform a DCSync attack, attackers initially compromise an account and then must gain additional, higher access rights, often including the following directory replication activities:

• Replicating Directory Changes
• Replicating Directory Changes All
• Replicating Directory Changes in Filtered Set

Tools and Commands

The primary tool used for performing DCSync attacks is Mimikatz. Mimikatz is a command-line utility that leverages the MS-DRSR protocol to obtain credentials.

Mimikatz Commands

Attackers execute a specific command format to retrieve NTLM password hashes of an administrator account:

mimikatz "lsadump::dcsync /domain:(domain name) /user:Administrator"

Or targeting the krbtgt key:

Invoke-Mimikatz -command '"lsadump::dcsync /domain: /user:<Any Domain User>"'

Attack Mechanism Details

Exploitation of Replication Protocol

The attack leverages the Domain Controller's replication functionality. A Domain Controller (DC) is configured to stockpile user accounts and data, and replication provides data flow across multiple DCs.

Mimicking a DC

The attacker first compromises and obtains privileged account access (often lower privileges initially). They then activate replication protocols to create a virtual DC similar to the original Active Directory.

Requesting Password Hashes

The attacker deploys specific tools, such as Mimikatz, to mimic a DC and sends a GetNCChanges command request to the compromised DC via MS-DRSR (Microsoft Directory Replication Service Remote Protocol).

DC Response

The legitimate DC accepts the request, acknowledges the replication request, and hands over password hashes (such as NTLM password hashes) to the attacker.

Post-Attack Activities

Once the attacker obtains NTLM password hashes via DCSync, they can use this information to launch further attacks, such as:

• Golden Ticket attacks
• Account manipulation
• "Living off the land" (LOTL) attacks
• Embedding ransomware in the compromised systems

Countermeasures against DCSync Attacks

To defend against DCSync attacks, organizations should implement the following countermeasures:

Permissions Review

Examine the permissions assigned to users and administrators, and keep track of the accounts that request domain replication rights.

Access Control Lists (ACLs)

Regularly audit and review ACL-based misconfigurations.

Deception Technology

Deploy deception surveillance tools and techniques such as honeypots and decoy credentials within the Active Directory environment.

Account Limitation

Limit the "Replicate Directory Changes" permission to authorized users and service accounts.

Network Monitoring

Deploy network surveillance tools to accumulate DC IP addresses and decide which IP addresses need to be included in the replication list.