Playing Around With ADIDNS RPC Internals Luke Paris 20 min read · 4 days ago -- Listen Share TL;DR: I ported the functionality of dnscmd.exe into (slightly) more OPSEC safe Beacon Object Files (BOFs) so you can get domain admin rights when you manage to impersonate a user that is a member of the DnsAdmins group; or if using dnscmd.exe simply isn’t an option. You can find the full source code here ! Regarding the process of getting to the final result, everything that could go wrong, did go wrong (and I learned a bunch)! Many thanks to @sud0woodo and @cochaviz and other unnamed peeps for mental support & reviewing my ramblings/detection rules Some Context A couple years ago, when I was doing an internal network penetration test at a client, I stumbled on a user which was a member of the DnsAdmins group. At the time, research by Shay Ber¹ had come out a few years prior showing how you could leverage these rights to gain RCE on a domain controller by loading a custom DLL file via the ServerLevelPluginDll config in the Active Directory Integrated DNS (ADIDNS) server. While this research was really cool, it lacked one issue: you had to find a way to restart the DNS server. I tried a bunch of stuff, got nowhere, and moved on with my life since I had domain admin creds to capture and it just wasn’t that practical to abuse at the time. A couple years later, I happened to run into the same attack path, and this time as Yuval Gordon from Semperni had cracked the case on how to get the server to restart². As it turns out, Microsoft has an undocumented /restart flag in the dnscmd.exe which just restarts the server and will load your DLL, all by just using the DnsAdmins group! So once more, I looked around to find a way to exploit this, but this time had a different issue: on every system we checked, we just couldn’t find a copy of the dnscmd.exe utility installed, and since I didn’t want to pollute our client’s systems by installing optional Windows features, installing it wasn’t really worth doing unless it’s the last resort. While I did have a nice C2 channel into the network, using the dnscmd.exe locally on my Windows Pentest VM, the tool just refused to work due to Kerberos and DNS getting in the way. So, yet again, I just gave up and just decided another approach would be faster, and shelved the technique yet again as “cool, but impractical”. This time around however, it left a burning question in my mind: So, I added yet another item to my ever growing pile of stupid project ideas, since at that point we got DA another way and had to get around to finishing that damn report. Back To The Present For some reason, last sunday, I was cleaning the house when for some reason this project idea just popped back into my mind. And since I now have a lot more room for R&D, I just thought, let’s give this a shot! So, monday morning, I got to work setting up a lab. As you do, I started with Windows Server 2022, promoted it to a DC, added some test users, and enrolled my other VM where I do my actual research stuff into the domain so DNS and Kerberos would be set up properly. It was at this point when I realized: “Oh shit, I forgot to name my domain controller to DC01 ! We wouldn’t want the screenshots looking bad right? I’ll just rename it quickly” Every person with any form of Windows sysadmin experience right now So I renamed my DC using the normal clicky click menus Microsoft provided me aaand.. Press enter or click to view image in full size Yeah I’m an idiot After debugging for an hour, I just decided it was faster to just nuke the machine and start over. Looking back I should have taken it as a message from heavenly forces trying to warn me about what kind of a chaotic week I’d have, but hey, I’m stubborn and once I set my mind on something it’s really hard for me to let it go. So, I pressed on. Working Towards a POC At first, I immediately fired up my reverse engineering tool of choice, dragged in the dnscmd.exe binary, at which point I thought: “Wait. Wasn’t there something about a technical specification somewhere in the original blog post?” So I looked up online if there was any documentation regarding the RPC itself, and as it turns out, yes! Microsoft publicly documents them: Press enter or click to view image in full size Thank you Microsoft :) After reading through the spec a bit, it quickly dawned on me I had absolutely no clue how to get started on this project, but I just kept Googling around and continued reading up on how to actually work with the MS RPC stuff natively. A few code examples, and a few really cool blog posts such as this really good blog post by 0xcsandker regarding offensive IPC internals on Windows ( seriously go read the entire series, it’s amazing) , and I felt comfortable enough to start writing a basic program. Since the Microsoft documentation stated that the first thing you need is an IDL definition file, I set my sights on writing one based off the publicly available spec, at which p...