AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
Huntress research shows AD RMS SLC root key is unrotatable and never expires, so its compromise permanently exposes all RMS-protected documents.
Part 2 of Huntress's AD RMS series details server-side attacks: extracting the Server Licensor Certificate (SLC) private key and performing offline decryption of protected documents. The SLC key has no expiry or rotation mechanism, with a 255-year certificate validity (2002–2258), so whoever recovers it can decrypt every document the deployment ever protected, indefinitely. The author released SharpRMS, a unified tool combining the 2016 DisARMS client-side attacks with new server-side key extraction and decryption capabilities. The research frames the SLC as comparable to KRBTGT and the DPAPI domain backup key, though not equivalent to domain compromise.
- SLC private key is the root of trust for every document an AD RMS deployment protects
- SLC key never expires and has no rotation mechanism; compromise is permanent and retroactive
- Only Service Group members can reach the admin surface where the key resides
- SharpRMS tool unifies client-side DisARMS attacks with new server-side key extraction
- SLC compromise equals total persistent decryption access, not domain compromise
- ATT&CK
- T1552 Unsecured CredentialsT1003 OS Credential DumpingT1140 Deobfuscate/Decode Files or Information
- Products
- AD RMSSQL ServerSharpRMS
- Organizations
- Huntress
From the original article
14 min read at huntress.comAn AD RMS Service Group account exports the AD RMS Server Licensor Certificate private key. That 1172-byte key decrypts every document the deployment ever protected, offline, and keeps doing so after the deployment is rebuilt.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.