- 🕵️ Akamai researchers discovered a new privilege escalation technique in Active Directory environments using the DHCP administrators group.
- 🛡️ The technique leverages legitimate features and doesn’t rely on any vulnerability, making it challenging to fix.
- 🔄 It can be used not only for privilege escalation but also as a domain persistence mechanism.
- 📊 Microsoft DHCP servers are popular, running in 40% of monitored networks, potentially exposing them to this technique.
- 🛠️ Mitigation steps are provided in the blog post to reduce the risk from this technique.
- 🔒 “Just enough access” is critical for minimizing risks in access management, especially in large organizations.
- 🚪 Managing access based on job function through user access groups is common, but vulnerabilities can still arise, as demonstrated in the “DNS Admins” group case.
- 🖥️ The DHCP administrators group manages DHCP servers but has no permissions over the server machine itself.
- 🚨 Attackers can abuse DHCP options to inject malicious configurations, like impersonating a WPAD server for credential theft.
- 🛡️ DHCP Coerce technique can lead to Kerberos relay attacks, potentially compromising the entire domain.
- 🔄 Attackers can establish a DHCP backdoor for domain persistence, utilizing DHCP scopes and relay agents.
- 🚑 Removing the DNS credential from the DHCP server can nullify some of the attack vectors.
- 📝 The DHCP relay agent feature allows an attacker to request an IP address from any scope, bypassing server interface restrictions.
- 🚧 To prevent rogue clients, the relay server’s IP address must be part of an existing scope on the server.
- ⚠️ An attacker can create a backdoor by setting up two scopes: an authorization scope and a coercion scope.
- 💻 PowerShell code can be used to create these scopes and trigger the backdoor.
- 🔍 Defensive measures include identifying risky DHCP configurations, mitigating relay attacks against AD CS, practicing DHCP administrators group hygiene, using segmentation to reduce the attack surface, and identifying DNS anomalies.
- 🔒 For mitigation, avoid installing DHCP servers on DCs, enable Extended Protection for Authentication on AD CS servers, and limit membership in the DHCP administrators group.
- 📡 Network segmentation can further mitigate the attack and reduce the attack surface.
- 🔎 Anomalies in DNS traffic can be a detection opportunity for this attack.
- 🛡️ Malicious privilege escalation leveraging legitimate processes poses a significant risk.
Abusing The Dhcp Administrators Group To Escalate Privileges In Windows Domains
