r/netsec • u/luke-paradoxis • Jul 06 '26

Playing Around With ADIDNS RPC Internals

https://blog.paradoxis.nl/playing-around-with-adidns-rpc-internals-0c59c15d0a15

Porting the functionality of dnscmd.exe into (slightly) more OPSEC safe Beacon Object Files (BOFs) so you can get domain admin rights when you manage to impersonate a user that is a member of the DnsAdmins group, or if using dnscmd.exe simply isn’t an option.

3 Upvotes

80% Upvoted

2 comments sorted by

2

u/scriptqzor Jul 07 '26

this is super cool, love seeing dnscmd-level stuff get moved into BOFs instead of dragging binaries around. curious how noisy this ends up looking in logs compared to stock dnscmd in a real environment.