Microsoft has shared guidance to help admins defend their Windows enterprise environments against KrbRelayUp attacks that enable attackers to gain SYSTEM privileges on Windows systems with default configurations.
Attackers can launch this attack using the KrbRelayUp tool developed by security researcher Mor Davidovich as an open-source wrapper for Rubeus, KrbRelay, SCMUACBypass, PowerMad/SharpMad, Whisker, and ADCSPwn privilege escalation tools.
Since late April 2022, when the tool was first shared on GitHub, threat actors could escalate their permissions to SYSTEM in Windows domain environments with default settings (where LDAP signing is not enforced).
Davidovich released an updated version of KrbRelayUp on Monday that also works when LDAP signing is enforced and will provide attackers with SYSTEM privileges if Extended Protection for Authentication (EPA) for Active Directory Certificate Services (AD CS) is not enabled.
Microsoft says that this privilege escalation tool doesn’t work against organizations with cloud-based Azure Active Directory environments.
However, KrbRelayUp can help compromise Azure virtual machines in hybrid AD environments where domain controllers are synchronized with Azure AD.
“Although this attack won’t function for Azure Active Directory (Azure AD) joined devices, hybrid joined devices with on-premises domain controllers remain vulnerable,” said Zeev Rabinovich and Ofir Shlomo of the Microsoft 365 Defender Research Team.
“If an attacker compromises an Azure virtual machine using a synchronized account, they’ll receive SYSTEM privileges on the virtual machine.”
Organizations should also consider setting the ms-DS-MachineAccountQuota attribute to 0 to make it more difficult for an attacker to leverage the attribute for attacks. Setting the attribute to 0 stops non-admin users from adding new devices to the domain, blocking the most effective method to carry out the attack’s first step and forcing attackers to choose more complex methods to acquire a suitable resource.
The Microsoft 365 Defender Research Team provides additional details on how the KrbRelayUp attack works and further info on how to strengthen device configurations here.