How Misconfigured SeDebugPrivilege Enables Windows Domain Controller Privilege Escalation
Summary
A lab walkthrough demonstrates how granting a standard domain user SeDebugPrivilege can enable LSASS credential extraction or SYSTEM token abuse on a Windows Domain Controller, and outlines Group Policy, LSA Protection, Credential Guard, and monitoring defenses.
Key points
- The lab assigns the Debug programs right through Group Policy to a standard domain user on a Windows Domain Controller.
- ProcDump creates an LSASS dump; pypykatz recovers an active Administrator session's NTLM hash, which the walkthrough uses to access the Domain Controller as Domain Administrator.
- In the demonstration, Meterpreter migration into winlogon.exe yields a SYSTEM session.
- SeDebugPrivesc duplicates a SYSTEM process token to spawn a command shell or reverse shell.
- The article recommends restricting Debug programs to Administrators and auditing Group Policy assignments.
- Suggested defenses include LSA Protection, Credential Guard, and an Attack Surface Reduction rule to block credential-stealing reads from LSASS.
- Suggested detection opportunities include ProcDump targeting LSASS, suspicious writes to winlogon.exe, unusual child processes or outbound connections, and token duplication.
Article Details
- Topic
- Abuse of SeDebugPrivilege for Windows privilege escalation on a Domain Controller
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 192[.]168[.]1[.]17 | Attacker-controlled Kali lab host used as the reverse-shell callback address in the demonstrated payloads. |
MITRE ATT&CK
T1003.001 · LSASS MemoryProcDump is used to dump LSASS memory, which pypykatz parses to recover credential material.T1021.006 · Windows Remote ManagementEvil-WinRM is used to establish a remote PowerShell session to the Domain Controller.T1055 · Process InjectionA Meterpreter session is migrated into winlogon.exe, using access to the process to obtain a SYSTEM session.T1059.001 · PowerShellThe attacker uses a remote PowerShell session and PowerShell commands to interact with the Domain Controller.T1105 · Ingress Tool TransferThe demonstrated payload and exploit binaries are uploaded to the Domain Controller through the Evil-WinRM session.T1134.001 · Token Impersonation/TheftSeDebugPrivesc duplicates a SYSTEM process token to spawn a shell as SYSTEM.T1550.002 · Pass the HashThe recovered Administrator NTLM hash is used with Evil-WinRM for Pass-the-Hash authentication.
People
Vendors
Products
Microsoft Active Directoryseveral distinct exploitation chains that each end with SYSTEM or Domain Administrator access on an Active Directory environment.Windows Server 2019The banner identifies the host as Windows 10.0.17763.737 — Windows Server 2019 — and a whoami confirms the shell is running as nt authoritysystem. The chain is complete: a standard domain user with nothing more than
Tools
Evil-WinRMThe attacker operates from a Kali Linux host at 192.168.1.17 using Evil-WinRM for remote PowerShell access.Metasploit FrameworkIn parallel, Metasploit is launched with a quiet banner and the multi-handler module is configured to catch the incoming connection.MeterpreterThe article demonstrates how tools like ProcDump, pypykatz, Meterpreter, and SeDebugPrivesc can turn that one delegated right into full domain compromise, while highlighting mitigations such as LSA Protection andmsfvenomThe first step generates a staged reverse TCP Meterpreter payload with msfvenom.netcatOn the Kali host, a Netcat listener is opened on port 443 — the same port encoded into the payload — and wrapped with rlwrap to provide line editing and command history for the incoming shell.ProcDumpThe article demonstrates how tools like ProcDump, pypykatz, Meterpreter, and SeDebugPrivesc can turn that one delegated right into full domain compromise, while highlighting mitigations such as LSA Protection andpypykatzThe article demonstrates how tools like ProcDump, pypykatz, Meterpreter, and SeDebugPrivesc can turn that one delegated right into full domain compromise, while highlighting mitigations such as LSA Protection andSeDebugPrivescThe article demonstrates how tools like ProcDump, pypykatz, Meterpreter, and SeDebugPrivesc can turn that one delegated right into full domain compromise, while highlighting mitigations such as LSA Protection and