Golden dMSA

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/Semperis/GoldenDMSA
• Blog Title: Golden dMSA
• Suggested Section: generic-hacking/active-directory-kerberos (new subsection for AD service account attacks)

🎯 Content Summary

Overview

Windows delegated Managed Service Accounts (dMSAs) and group Managed Service Accounts (gMSAs) derive their passwords on the Domain Controller (DC) using a KDS (Key Distribution Service) Root Key and a per‐account ManagedPasswordID (GUID). The password is computed as an AES256‐HMAC of the SID and ManagedPasswordID, then Base64‐encoded and stored in the msDS-ManagedPassword attribute.

Golden dMSA Attack

By extracting the DC’s KDS Root Key and enum...

🔧 Technical Details

Golden dMSA Attack: Allows offline derivation of any Active Directory delegated or group Managed Service Account password by extracting the DC’s KDS Root Key and computing the AES256‐HMAC of the account SID and ManagedPasswordID, bypassing all live Kerberos requests.

Key Material Extraction: Dump the KDS Root Key from a Domain Controller (requires Enterprise Admin or SYSTEM) via Volume Shadow Copy, registry hive export (reg save HKLM\\SECURITY🤖 Agent Actions

Added comprehensive coverage of the Golden gMSA/dMSA attack:

1. Created new file
   src/windows-hardening/active-directory-methodology/golden-dmsa-gmsa.md
   • Explains MSA password derivation, attack prerequisites, 4-phase workflow, tooling, detection & mitigation.
   • Includes detailed command examples with GoldenDMSA, mimikatz, etc.
   • Provides references section with blog and related research links.

2. Updated Active-Directory methodology README
   • Inserted internal cross-reference to the new page inside the “Compromise any gMSA in the forest” subsection for easy navigation.

These changes document the latest offline Managed Service Account password-derivation technique and integrate it into existing AD attack paths.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/Semperis/GoldenDMSA

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/active-directory-kerberos (new subsection for AD service account attacks)".

Repository Maintenance:

• MD Files Formatting: 854 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge