๐ย Secure Bits ๐ก
๐๐ถ๐ฑ ๐๐ผ๐ ๐ธ๐ป๐ผ๐ ๐๐ต๐ฒ๐ฟ๐ฒโ๐ ๐ฎ ๐น๐ผ๐ฐ๐ฎ๐น ๐๐ฑ๐บ๐ถ๐ป๐ถ๐๐๐ฟ๐ฎ๐๐ผ๐ฟ ๐ฎ๐ฐ๐ฐ๐ผ๐๐ป๐ ๐ผ๐ป ๐๐ผ๐บ๐ฎ๐ถ๐ป ๐๐ผ๐ป๐๐ฟ๐ผ๐น๐น๐ฒ๐ฟ๐?
Yes โ itโs theย DSRM accountย (Directory Services Restore Mode), used inย disaster recoveryย scenarios when AD is offline.
But it can also beย abused as a persistence mechanism.
๐ย ๐๐ ๐ฑ๐ฒ๐ณ๐ฎ๐๐น๐, ๐๐ต๐ฒ ๐๐ฆ๐ฅ๐ ๐ฎ๐ฐ๐ฐ๐ผ๐๐ป๐:
โ Is local-only
โ Doesnโt allow interactive or network login
โ Stores its password hash in the local SAM
โ Is not visible in AD or subject to normal domain policies
๐ย ๐๐ ๐ฐ๐ฎ๐ป ๐ฏ๐ฒ ๐ฒ๐ป๐ฎ๐ฏ๐น๐ฒ๐ฑ ๐๐๐ถ๐ป๐ด ๐๐ต๐ถ๐ ๐ฟ๐ฒ๐ด๐ถ๐๐๐ฟ๐ ๐ธ๐ฒ๐:
HKLMSYSTEMCurrentControlSetControlLsa
โย DsrmAdminLogonBehavior
0ย or missing = login disabled
1ย = allows local login
2ย = allowsย network authenticationย (e.g. NTLM)
๐ ๏ธ If an attacker has the DSRM hash and the registry is set toย 2, they can authenticate over the network โ even to a Domain Controller.
โ
ย ๐๐ฒ๐๐ ๐ฝ๐ฟ๐ฎ๐ฐ๐๐ถ๐ฐ๐ฒ๐:
โ Change the DSRM password periodically
โ Review the registry key across all DCs
โ Monitor for usage of the DSRM account
๐๐ถ๐ฑ ๐๐ผ๐ ๐ธ๐ป๐ผ๐ ๐ฎ๐ฏ๐ผ๐๐ ๐๐ต๐ถ๐?
๐ Full article by Abdul Mhanni โ https://www.abdulmhsblog.com/posts/dsrmadmin/
