Simulating Legitimate Active Directory Services on the Netwo...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://synacktiv.com/en/publications/simulating-legitimate-active-directory-services-on-the-network-the-case-of-gpo.html
• Blog Title: Simulating Legitimate Active Directory Services on the Network: The Case of GPO Exploitation
• Suggested Section: Windows Hardening > Active Directory Methodology > Group Policy/GPO Abuse, with cross-references from Abusing Active Directory ACLs/ACEs, NTLM Relay, LDAP, SMB, and Kerberos

🎯 Content Summary

Overview

Synacktiv presents reusable Python implementations of authenticated SMB and LDAP services designed to impersonate legitimate Active Directory services. The implementations build on Scapy and Gabriel Potter's Windows protocol layers, and are integrated into GPOddity and OUned. The SMB server supports multiple authenticated SMB sessi...

🔧 Technical Details

Authenticated GPC/GPT redirection through gPCFileSysPath: If a principal can modify a GPO's LDAP-based GPC, directly or through an LDAP relay, it can replace gPCFileSysPath with an attacker-controlled UNC path. The remote SMB server must genuinely validate the incoming domain identity, derive the correct session key, and sign SMB traffic because modern Windows clients reject anonymous remote SMB and Secure Negotiate checks that authentication succeeded. The server can then return a malicious GPT containing an Immediate Task or Scheduled Task that the privileged Group Policy client executes as SYSTEM.

SMB2 session multiplexing for user GPO attacks: Post-MS16-072 user-policy retrieval creates two authenticated SMB sessions inside one TCP connection: the user retrieves GPT.INI, and the machine account retrieves policy files such as ScheduledTasks.xml. Every session has a distinct SMB2 🤖 Agent Actions

Updated:

src/windows-hardening/active-directory-methodology/acl-persistence-abuse/README.md

Added concise technical coverage of:

• Authenticated gPCFileSysPath poisoning with GPOddity
• SMB2 multi-session multiplexing for user GPOs
• gPLink poisoning with OUned
• Kerberos/SPNEGO-authenticated rogue LDAP services
• Kerberos AES salt caveats
• Relevant detection pivots
• Usage/configuration examples and numbered primary references

Validation: git diff --check passes. Full mdBook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://synacktiv.com/en/publications/simulating-legitimate-active-directory-services-on-the-network-the-case-of-gpo.html

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening > Active Directory Methodology > Group Policy/GPO Abuse, with cross-references from Abusing Active Directory ACLs/ACEs, NTLM Relay, LDAP, SMB, and Kerberos".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0