Security1 publisher2 min readPublished
One Server Licensor Certificate key decrypts every document an AD RMS deployment ever protected
Huntress's second post on Active Directory Rights Management Service traces every protected document back to one private key. The certificate runs 255 years, the key has no expiry, and the product ships no way to rotate it.
The Watch · Security desk
What happened
- Huntress's second AD RMS post covers how to reach the Server Licensor Certificate private key, what an attacker does with it, and why that access persists long after the attacker leaves.
- The SLC certificate carries a 255-year validity period, and the private key itself has no expiry and no rotation mechanism.
- In the research lab only Service Group members reach the admin surface and the key; a user holding a content grant and a plain domain user reach neither.
- Client-side protection stripping was published at WOOT 2016 by Martin Grothe, Christian Mainka, Paul Roesler and Joerg Schwenk, whose DisARMS work defeated view only, no print, no copy and expiration.
- Huntress rates the SLC alongside KRBTGT and the DPAPI domain backup key as a long-lived cluster root that protects everything beneath it.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Every surviving copy of a protected file is in scope, so backups, mail archives and decommissioned laptops an organisation stopped tracking years ago become readable to whoever holds the key.
- constraint Containment ends the intruder's access to the service and leaves the copied key valid, so the usual post-incident root-key reset has nothing to act on.
- decision Defenders have to settle whether RMS Service Group membership belongs in the same protected tier as domain admin, since that membership is the gate to the key.
- capability A single binary carrying both client-side stripping and server-side key recovery lowers the skill needed to run the full attack if that tooling circulates.
Every publishing license an AD RMS deployment has ever issued carries a content key encrypted to the SLC public key, and the server decrypts that content key with the SLC private key on every document open [4]. Hold the private half and you do that decryption yourself. The protected content never reaches the RMS servers [6], so the exposure is not a server-side archive: Huntress lists files pulled from a share long ago, mail deleted from the server, and documents on machines since decommissioned as all still readable to whoever holds the key [5].
Because the content key rides inside the publishing license and the ciphertext never transited the service, decryption after extraction needs no further contact with the deployment [15].
Huntress draws the boundary itself. "This attack is not a DCSync equivalent. The SLC key is not AD credentials, and this is not domain compromise. It is a total, permanent compromise of everything the RMS service protects, for every user, which is a different thing and the subject of the rest of this post," the post said [7].
Part 1 of the series established that any domain user can discover the deployment and fingerprint which files are RMS-protected from recon alone [9]. So an intruder builds the target list with an ordinary account, and still needs Service Group membership, or a path to it, before the key is in reach [18].
The validity window is deliberate, according to the post: every AD RMS server enrolls as the leaf of a fixed Microsoft certificate chain that ships inside the product, beginning with a DRM Production Root [14]. Once a copy of the private key leaves the building, remediation has no rotation step to run, because the product provides none [16].
What the published material does not carry is the extraction itself. The steps for pulling the key off the service host or out of the SQL configuration database are not in it, and it does not say whether SharpRMS has been released publicly [20].
What to watch
- Whether Huntress publishes the extraction steps or releases SharpRMS, which would move this from research writeup to available tooling.
- Microsoft guidance on hardening AD RMS Service Group membership or re-protecting content under a new cluster root.
- An intrusion report naming SLC key theft as the reason archived documents stayed readable after the intruder was evicted.