Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly

Detail

Threat actors are increasingly abusing Active Directory replication functionality to obtain password hashes and other credential material without directly compromising a Domain Controller. This technique, known as DCSync, abuses legitimate Active Directory replication mechanisms to make a compromised system appear as a legitimate replication partner.

In a normal Active Directory environment, Domain Controllers synchronize directory information through the Directory Replication Service Remote Protocol (DRS/RPC). This process allows changes such as password updates, group membership modifications, and account attributes to be replicated across Domain Controllers. DCSync becomes possible when an attacker obtains an account with sufficient directory replication privileges. These privileges are commonly associated with highly privileged accounts, including Domain Admins, Enterprise Admins, and Administrators, but may also be delegated to service accounts or other identities.

The attack can expose sensitive credential material, including NTLM password hashes and Kerberos key material. High-value targets may include the krbtgt account, Domain Administrator accounts, privileged service accounts, and accounts with access to critical infrastructure, backup systems, cloud environments, or security platforms. Compromise of the krbtgt account is particularly severe because its credentials can be used to create forged Kerberos authentication tickets, commonly known as Golden Tickets, potentially providing persistent and highly privileged access to the domain.

How?

Unlike traditional credential-dumping techniques, DCSync does not require the attacker to execute malicious code directly on a Domain Controller or extract credentials from its memory.

After obtaining an account with the required replication permissions, the attacker can use tools such as Mimikatz, Impacket, or custom implementations to request replication data from a legitimate Domain Controller. The attacker abuses replication operations such as DRSGetNCChanges to request credential-related information.

Because the activity uses legitimate Active Directory replication functionality, the network traffic can resemble normal communication between Domain Controllers. This can make DCSync more difficult to identify using traditional endpoint security controls that primarily rely on detecting known tools, malicious binaries, or suspicious memory activity.

A key behavioral indicator is a non-Domain Controller system initiating directory replication requests. Replication activity originating from workstations, application servers, jump hosts, or other systems that are not recognized Domain Controllers should therefore be investigated.

Relevant monitoring sources may include:

• Active Directory security auditing
• Windows Security Event ID 4662
• Network telemetry associated with DRS/RPC activity
• Privileged account and authentication logs
• Identity Detection and Response (IDR) platforms
• SIEM and XDR telemetry

Impact

The rootkit allows attackers to achieve server-side code execution while avoiding the need to store the final web shell on disk. Because the malicious content is created in memory when targeted PHP files are accessed, the content observed by Apache and PHP can differ from the content stored on the filesystem.

This can make traditional file-based inspection less effective and may cause responders who focus exclusively on filesystem evidence to overlook important evidence. The malware also provides an interactive shell through the /run/bigtlog.pipe Unix domain socket.

Sophos identified several signals defenders can investigate on affected Apache servers, including requests involving the targeted .php3 files, PHP endpoints returning HTTP 201 while claiming to serve CSS content, and Apache worker processes that read /proc/self/maps and subsequently modify memory permissions.

Recommendation

Organizations should restrict Active Directory replication permissions to only accounts and systems that legitimately require them. Regularly review the permissions and access control lists associated with the domain naming context to identify unnecessary or unexpected replication privileges.

Particular attention should be given to service accounts and delegated accounts that possess replication permissions, as these accounts may provide attackers with an alternative path to obtain domain-wide credential material.

Security teams should also establish monitoring for replication requests originating from systems that are not authorized Domain Controllers. Any unexpected replication activity should be investigated together with the associated account, source host, authentication activity, and other indicators of compromise.

Where DCSync activity is suspected, the affected privileged credentials and potentially compromised accounts should be assessed promptly, with additional focus on the krbtgt account due to the potential for Golden Ticket abuse.

Overall, DCSync demonstrates that attackers do not necessarily need direct access to a Domain Controller to obtain highly sensitive Active Directory credentials. By abusing legitimate replication functionality, an attacker with sufficient privileges can potentially obtain the credentials required to compromise the wider domain.

Source

https://gbhackers.com/hackers-steal-active-directory-password-hashes/