Pentesting
Cheatsheet and Notes for Altered security's CRTP course
General
• Check tickets -
• Copy files remotely -
• Always use loader.exe to run binaries.
• Registry query for scripts policy -
• With admin privileges:
• With non-admin privileges(preferred):
• Type exit from the new PowerShell session to complete the clean-up. • Show all tasks -
• Access C disk of a computer (check local admin)
• Powershell reverse shell
• Use this parameter to not print errors powershell
• Rename powershell windows
• Impacket PSexec impacket
If no LM Hash use an empty one: aad3b435b51404eeaad3b435b51404ee
• Disable AV monitoring
• Check the language mode
• Enumerate applocker policy
Powershell Scripts and Modules
• Load a PowerShell script using dot sourcing
• A module (or a script) can be imported with:
• All the commands in a module can be listed with:
• Download execute cradle
• PSv3 onwards -
• Copy script to other server
Execution Policy Bypasses
Not a security measure. Just to prevent users from accidentally executing scripts.
Bypassing AV signatures
For partial obfuscation -
Scan using AMSITrigger
Modify the detected code snippet
Rescan using AMSITrigger
Repeat the steps 2 & 3 till we get a result as “AMSI_RESULT_NOT_DETECTED” or “Blank”
If There are multiple detections. We need to make the following changes:
Remove the comments.
Modify each use of "DumpCreds".
Modify the variable names of the Win32 API calls that are detected.
Reverse the strings that are detected and the dll strings .
For full obfuscation -
AMSI Bypass
For .NET AMSI bypass
Domain Enumeration
For enumeration we can use the following tools
Domain Enumeration Commands
• Get current domain
• Get object of another domain
• Get domain SID for the current domain
• Get domain policy for the current domain
• Get domain policy for another domain
• Get domain controllers for the current domain
• Get domain controllers for another domain
• Get the domain password policy
• Get a list of users in the current domain
• Get list of all properties for users in the current domain
• Search for a particular string in a user's attributes:
• Get list of usernames, last logon and password last set
• Get list of usernames and their groups
• Get list of all properties for users in the current domain
• Get a list of computers in the current domain
• Get all the groups in the current domain
• Get all groups containing the word "admin" in group name
• Get all the members of the Domain Admins group
• Get all the members of the Enterprise Admins group
• Get the group membership for a user:
• List all the local groups on a machine (needs administrator privs on non-dc machines) :
• Get members of the local group "Administrators" on a machine (needs administrator privs on non-dc machines) :
• Get actively logged users on a computer (needs local admin rights on the target)
• Get locally logged users on a computer (needs remote registry on the target - started by-default on server OS)
• Get the last logged user on a computer (needs administrative rights and remote registry on the target)
• Find shared on hosts in the current domain (noisy):
• Find sensitive files on computers in the domain (Noisy):
• Get all fileservers of the domain (Noisy):
Group Policy Enumeration
• Get list of GPO in current domain.
• Get GPO(s) which use Restricted Groups or groups.xml for interesting users
• Get users which are in a local group of a machine using GPO
• Get machines where the given user is member of a specific group
• Get OUs in a domain
• Get GPO applied on an OU (Read GPOname from gplink attribute from Get-NetOU)
• Get machines that are part of an OU
Access Control Lists (ACL) Enumeration
• Get the ACLs associated with the specified object
• Get the ACLs associated with the specified prefix to be used for search
• We can also enumerate ACLs using ActiveDirectory module but without resolving GUIDs
• Get the ACL's associated with the specified path
• Search for interesting ACL's
• Search of interesting ACL's for the current user
Domain Trusts
• Get a list of all domain trusts for the current domain
• Get details about the current forest
• Get all domains in the current forest
• Get all global catalogs for the current forest
• Map trusts of a forest
User Hunting
• Find all machines on the current domain where the current user has local admin access
• This function queries the DC of the current or provided domain for a list of computers (Get-NetComputer) and then use multi-threaded Invoke-CheckLocalAdminAccess on each machine.
• This can also be done with the help of remote administration tools like WMI and PowerShell remoting. Pretty useful in cases where ports (RPC and SMB) used by Find-LocalAdminAccess are blocked.
• See Find-WMILocalAdminAccess.ps1 and Find-PSRemotingLocalAdminAccess.ps1
• Find computers where a domain admin (or specified user/group) has sessions:
• This function queries the DC of the current or provided domain for members of the
given group (Domain Admins by default) using Get-DomainGroupMember, gets a
list of computers (Get-DomainComputer) and list sessions and logged on users
(Get-NetSession/Get-NetLoggedon) from each machine.
• Note that for Server 2019 and onwards, local administrator privileges are required
to list sessions.
• Find computers where a domain admin session is available and current user
has admin access (uses Test-AdminAccess).
• Find computers (File Servers and Distributed File servers) where a domain admin session is available.
• Find local admins on all machines of the domain (needs admin privs)
• Connect to machine with administrator privs
• Save and use sessions of a machine
• Find active sessions
BloodHound
• Supply data to BloodHound (Remember to bypass .NET AMSI):
Then,
or
• The generated archive can be uploaded to the BloodHound application.
• To make BloodHound collection stealthy, use –Stealth option. This removes noisy collection methods like RDP, DCOM, PSRemote and LocalAdmin :
or
• To avoid detections like MDI -
Local Privilege Escalation
• Ways to locally escalating privileges on Windows box:
Missing patches
Automated deployment and AutoLogon passwords in clear text
AlwaysInstallElevated (Any user can run MSI as SYSTEM)
Misconfigured Services
DLL Hijacking and more
NTLM Relaying a.k.a. Won't Fix
• We can use below tools for complete coverage
• Run all checks from :
PowerUp
Invoke-AllChecksPrivesc:
Invoke-PrivEscPEASS-ng:
winPEASx64.exe
Services Issues using PowerUp
• Get services with unquoted paths and a space in their name.
• Get services where the current user can write to its binary path or change arguments to the binary
• Get the services whose configuration current user can modify.
• Abuse service to get local admin permissions with powerup
Feature Abuse
Jekins
• Lets assume there is a Jenkins server running on dcorp-ci (172.16.3.11) on port 8080.
• Apart from numerous plugins, there are two ways of executing commands on a Jenkins Master.
• If you have Admin access (default installation before 2.x), go to http://<jenkins_server>/script
• In the script console, Groovy scripts could be executed.
• If you don't have admin access but could add or edit build steps in the build configuration. Add a build step, add "Execute Windows Batch Command" and enter:
• Again, you could download and execute scripts, run encoded scripts and more.
Add user to local admin and RDP group and enable RDP on firewall
Lateral Movement
Powershell Remoting
One-to-One
PSSession – Interactive – Runs in a new process (wsmprovhost) – Is Stateful
Useful cmdlets –
New-PSSession–Enter-PSSession
• Connect to machine with administrator privs
One-to-Many Also known as Fan-out remoting.
• Non-interactive.
• Executes commands parallely.
• Useful cmdlets
• Run commands and scripts on
multiple remote computers,
in disconnected sessions (v3)
as background job and more.
• The best thing in PowerShell for passing the hashes, using credentials and executing commands on multiple remote computers.
• Use -Credential parameter to pass username/password.
• Use below to execute commands or scriptblocks:
• Use below to execute scripts from files
• Download and load script on a machine
• Use below to execute locally loaded function on the remote machines:
• In this case, we are passing Arguments. Keep in mind that only positional arguments could be passed this way:
• below, a function call within the script is used:
• Use below to execute "Stateful" commands using Invoke-Command:
• We can use winrs in place of PSRemoting to evade the logging (and still reap the benefit of 5985 allowed between hosts):
• Dump credentials on a local machine using Mimikatz.
• Using SafetyKatz (Minidump of lsass and PELoader to run Mimikatz)
• Dump credentials Using SharpKatz (C# port of some of Mimikatz functionality).
• Dump credentials using Dumpert (Direct System Calls and API unhooking)
• Using pypykatz (Mimikatz functionality in Python)
• Using comsvcs.dll
• Mimikatz start powershell pass the hash (run as local admin)
• Mimikatz dump from SAM
or
• Mimikatz dump lsa (krbtgt to)
• Over Pass the hash (OPTH) generate tokens from hashes or keys. Needs elevation (Run as administrator)
• Below doesn't need elevation
• To extract credentials from the DC without code execution on it, we can use DCSync.To use the DCSync feature for getting krbtgt hash to execute the below command with DA privileges for us domain(Domain Admins privileges required):
• Port forwarding using winrs -
• Run Safetykatz through winrs port forwarding
Offensive .NET Tradecraft
AV bypass
• For that, we can use techniques like Obfuscation, String Manipulation etc.
• This helps us in deciding on modifying the source code and minimal obfuscation.
String Manipulation
Open the project in Visual Studio.
Press "CTRL + H".
Find and replace the string "Credentials" with "Credents" you can use any other string as an replacement. (Make sure that string is not present in the code)
Select the scope as "Entire Solution".
Press "Replace All" button.
Build and recheck the binary with DefenderCheck.
Repeat above steps if still there is detection
Example - Safetykatz.exe
Download latest version of Mimikatz and Out-CompressedDll.ps1
Run the Out-CompressedDll.ps1 PowerShell script on Mimikatz binary and save the output to a file.
Copy the value of the variable "$EncodedCompressedFile" from the output file above and replace the value of "compressedMimikatzString" variable in the "Constants.cs" file of SafetyKatz.
Copy the byte size from the output file and replace it in "Program.cs" file on the line 111 & 116.
Build and recheck the binary with DefenderCheck
Obfuscation
Launch ConfuserEx • In Project tab select the Base Directory where the binary file is located. • In Project tab Select the Binary File that we want to obfuscate. • In Settings tab add the rules. • In Settings tab edit the rule and select the preset as
Normal. • In Protect tab click on the protect button.We will find the new obfuscated binary in the Confused folder under the Base Directory.
Payload Delivery
• It can be used to load binary from filepath or URL and patch AMSI & ETW while executing.
• We also have AssemblyLoad.exe that can be used to load the Netloader in-memory from a URL which then loads a binary from a filepath or URL.
Persistence
• Dump hashes - Get the krbtgt hash
• Use the DCSync feature for getting krbtgt hash. Execute with DA privileges (or a user that has replication rights on the domain object):
• Check WMI Permission
Golden ticket (Access to all Computers and services)
Use /ticket instead of /ptt to save the ticket to file instead of loading in current powershell process. To get the SID use Get-DomainSID from powerview.
Get-DomainSID from powerview.Silver Ticket (Access to only one service)
•Using the hash of the computer
•Using the hash of the Domain Controller computer account
•Check access (After CIFS silver ticket)
•Make silver ticket for Host
•Schedule and execute a task after silver ticket (Noisy)
•Make silver ticket for WMI . Execute for WMI /service:HOST /service:RPCSS
Diamond Ticket (Better Golden Ticket)
• We would still need krbtgt AES keys. Use the following Rubeus command to create a diamond ticket (note that RC4 or AES keys of the user can be used too):
• We could also use /tgtdeleg option in place of credentials in case we have access as a domain user:
Skeleton Key (patch a Domain Controller) (Dangerous)
• Use the below command to inject a skeleton key (password would be mimikatz) on a Domain Controller of choice. DA privileges required
• Now, it is possible to access any machine with a valid username and password as "mimikatz"
• In case lsass is running as a protected process, we can still use Skeleton Key but it needs the mimikatz driver (mimidriv.sys) on disk of the target DC(very noisy):
DSRM
• DSRM is Directory Services Restore Mode.
• There is a local administrator on every DC called "Administrator" whose password is the DSRM password.
• DSRM password (SafeModePassword) is required when a server is promoted to Domain Controller and it is rarely changed.
• After altering the configuration on the DC, it is possible to pass the NTLM hash of this user to access the DC.
• Dump DSRM password (needs DA privs)
• Compare the Administrator hash with the Administrator hash of below command
• Change login behavior for the local admin on the DC
• If property already exists
• Pass the hash for local admin
Custom SSP (mimilib.dll) (Dangerous)
• We can use either of the ways:
Drop the mimilib.dll to system32 and add mimilib to
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SecurityPackages:
Using mimikatz, inject into lsass (Not super stable with Server 2019 and Server 2022 but still usable):
• All local logons on the DC are logged to C:\Windows\system32\mimilsa.log
ACL - AdminSDHolder
• Resides in the System container of a domain and used to control the permissions - using an ACL - for certain built-in privileged groups (called Protected Groups).
• Security Descriptor Propagator (SDPROP) runs every hour and compares the ACL of protected groups and members with the ACL of AdminSDHolder and any differences are overwritten on the object ACL. • With DA privileges (Full Control/Write permissions) on the AdminSDHolder object, it can be used as a backdoor/persistence mechanism by adding a user with Full Permissions (or other interesting permissions) to the AdminSDHolder object.
• In 60 minutes (when SDPROP runs), the user will be added with Full Control to the AC of groups like Domain Admins without actually being a member of it.
• Add FullControl permissions for a user to the AdminSDHolder using PowerView as DA:
• Other interesting permissions (ResetPassword, WriteMembers) for a user in the AdminSDHolder:
• Run SDProp manually using Invoke-SDPropagator.ps1 from Tools directory:
• For pre-Server 2008 machines:
• Check the Domain Admins permission - PowerView as normal user:
• Using ActiveDirectory Module:
•Add user to domain admin group
• Abusing FullControl using PowerView:
• Using ActiveDirectory Module:
• Abusing ResetPassword using PowerView:
• Using ActiveDirectory Module:
Rights Abuse (DCSync)
• With DA privileges, the ACL for the domain root can be modified to provide useful rights like FullControl or the ability to run "DCSync".
•Check if student has replication rights
• Add FullControl rights:
• Using ActiveDirectory Module and RACE:
• Add rights for DCSync:
• Using ActiveDirectory Module and RACE:
• Execute DCSync:
Security Descriptors
WMI
• On a local machine
• On a remote machine without explicit credentials
•On a remote machine with explicit credentials(Only root/cimv and nested namespaces)
•On remote machine remove permissions
Powershell Remoting
• On a local machine
•On a remote machine without credentials
•On a remote machine remove permissions
Remote Registry
Using the RACE or DAMP toolkit
•Using DAMP with admin privs on remote machine
•Retrieve machine account hash from local machine
•Retrieve local account hash from local machine
•Retrieve domain cached credentials from local machine
Domain Privilege Escalation
Kerberoasting
• Find user accounts used as Service accounts
• Use Rubeus to list Kerberoast stats
• Use Rubeus to request a TGS
• To avoid detections based on Encryption Downgrade for Kerberos EType (used by likes of MDI - 0x17 stands for rc4-hmac), look for Kerberoastable accounts that only support RC4_HMAC
• Kerberoast all possible accounts
• Crack ticket using John the Ripper
• Reguest a TGS
• Export ticket using Mimikatz
• Crack the ticket
AS-REProasting
• If a user's UserAccountControl settings have "Do not require Kerberos preauthentication" enabled i.e. Kerberos preauth is disabled, it is possible to grab user's crackable AS-REP and brute-force it offline.
• With sufficient rights (GenericWrite or GenericAll), Kerberos preauth can be forced disabled as well.
• Enumerating accounts with Kerberos Preauth disabled
Using PowerView:
Using ActiveDirectory module:
• Force disable Kerberos Preauth: • Let's enumerate the permissions for RDPUsers on ACLs using PowerView:
• Request encrypted AS-REP
• Enumerate all users with kerberos preauth disabled and request a hash
• Cracking the hash
Set SPN
• With enough rights (GenericAll/GenericWrite), a target user's SPN can be set to anything (unique in the domain).
• We can then request a TGS without special privileges. The TGS can then be "Kerberoasted".
• Let's enumerate the permissions for RDPUsers on ACLs using PowerView:
• Using Powerview, see if the user already has a SPN:
• Using ActiveDirectory module:
• Set a SPN for the user (must be unique for the domain)
• Using ActiveDirectory module:
•Request a TGS
•Export ticket to disk for offline cracking
•Request TGS hash for offline cracking hashcat
•Crack the hash with hashcat.(Edit the hash by inserting '23' after the , so .....)
OR • Kerberoast the user
Kerberos Delegation
• Kerberos Delegation allows to "reuse the end-user credentials to access resources hosted on a different server".
• This is typically useful in multi-tier service or applications where Kerberos Double Hop is required.
• Please note that, for the above example, the service account for web service must be trusted for delegation to be able to make requests as a user.
Unconstrained
• When set for a particular service account, unconstrained delegation allows delegation to any service to any resource on the domain as a user.
• When unconstrained delegation is enabled, the DC places user's TGT inside TGS (Step 4 in the previous diagram). When presented to the server with unconstrained delegation, the TGT is extracted from TGS and stored in LSASS. This way the server can reuse the user's TGT to access any other resource as the user.
• This could be used to escalate privileges in case we can compromise the computer with unconstrained delegation and a Domain Admin connects to that machine.
Discover domain computers which have unconstrained delegation enabled using PowerView:
Using ActiveDirectory module:
Compromise the server(s) where Unconstrained delegation is enabled. We must trick or wait for a domain admin to connect a service on appsrv.
Now, if the command is run again:
The DA token could be reused:
To force a high-privilege user to connect to a machine we can abuse the printer bug.
We can capture the TGT of dcorp-dc$ by using Rubeus on dcorp-appsrv:
• Copy the base64 encoded TGT, remove extra spaces (if any) and use it on the student VM:
• Once the ticket is injected, run DCSync:
Constrained Delegation
• Constrained Delegation when enabled on a service account, allows access only to specified services on specified computers as a user.
• Enumerate users and computers with constrained delegation enabled • Using PowerView
• Using ActiveDirectory module:
For user
Abusing with Kekeo • Either plaintext password or NTLM hash/AES keys is required. We already have access to websvc's hash from dcorp-adminsrv • Using asktgt from Kekeo, we request a TGT (steps 2 & 3 in the diagram):
• Using s4u from Kekeo, we request a TGS (steps 4 & 5):
• Using mimikatz, inject the ticket:
Abusing with Rubeus • We can use the following command (We are requesting a TGT and TGS in a single command):
For computers
Abusing with Kekeo • Either plaintext password or NTLM hash is required. If we have access to dcorp-adminsrv hash
• Using asktgt from Kekeo, we request a TGT:
• Using s4u from Kekeo_one (no SNAME validation):
• Using mimikatz:
Abusing with Rubeus • We can use the following command (We are requesting a TGT and TGS in a single command):
• After injection, we can run DCSync:
Resource-based
• To abuse RBCD in the most effective form, we just need two privileges.
Write permissions over the target service or object to configure msDS-AllowedToActOnBehalfOfOtherIdentity.
Control over an object which has SPN configured (like admin access to a domain joined machine or ability to join a machine to domain - ms-DS-MachineAccountQuota is 10 for all domain users)
• Enumeration would show that the user 'ciadmin' has Write permissions over the dcorp-mgmt machine
• Using the ActiveDirectory module, configure RBCD on dcorp-mgmt for student machines :
• Now, let's get the privileges of dcorp-studentx$ by extracting its AES keys:
• Use the AES key of dcorp-studentx$ with Rubeus and access dcorp-mgmt as ANY user we want:
DNS Admins
• Enumerate member of the DNS admin group
• From the privilege of DNSAdmins group member, configue DDL using dnscmd.exe (needs RSAT DNS). Share the directory the ddl is in for everyone so its accessible. logs all DNS queries on C:\Windows\System32\kiwidns.log
• Restart DNS
Cross-Domain(Child-Parent) Privilege Escalation
Using Trust Tickets
• So, what is required to forge trust tickets is, obviously, the trust key. Look for [In] trust key from child to parent.
• We can forge an inter-realm TGT:
Abuse with Kekeo • Get a TGS for a service (CIFS below) in the target domain by using the forged trust ticket.
• Use the TGS to access the targeted service.
• Tickets for other services (like HOST and RPCSS for WMI, HTTP for PowerShell Remoting and WinRM) can be created as well.
Abuse with Rubeus • Note that we are still using the TGT forged initially
Using Krbtgt Hashes
• We will abuse sIDhistory once again
• In the above command, the mimkatz option "/sids" is forcefully setting the sIDHistory for the Enterprise Admin group for dollarcorp.moneycorp.local that is the Forest Enterprise Admin Group.
•Get SID of enterprise admin
• On any machine of the current domain
• Avoid suspicious logs by using Domain Controllers group
• S-1-5-21-2578538781-2508153159-3419410681-516 - Domain Controllers • S-1-5-9 - Enterprise Domain Controllers
Cross-Forest Privilege Escalation
Trust Abuse
• We require the trust key for the inter-forest trust.
• An inter-forest TGT can be forged
Abuse with Kekeo
• Get a TGS for a service (CIFS below) in the target domain by using the forged trust ticket.
• Use the TGS to access the targeted service.
• Tickets for other services (like HOST and RPCSS for WMI, HTTP for PowerShell Remoting and WinRM) can be created as well.
Abuse with Rubeus
• Using the same TGT which we forged earlier:
• Enumerate the templates.:
• Enumerate vulnerable templates:
• Convert pem to pfx -
ESC1
• The template "HTTPSCertificates" has ENROLLEE_SUPPLIES_SUBJECT value for msPKI-Certificates-Name-Flag.
• The template "HTTPSCertificates" allows enrollment to the RDPUsers group. Request a certificate for DA (or EA) as studentx
• Convert from cert.pem to pfx (esc1.pfx below) and use it to request a TGT for DA (or EA).
ESC3
• The template "SmartCardEnrollment-Agent" allows Domain users to enroll and has "Certificate Request Agent" EKU.
• The template "SmartCardEnrollment-Users" has an Application Policy Issuance Requirement of Certificate Request Agent and has an EKU that allows for domain authentication. Search for domain authentication EKU:
Escalation to DA • We can now request a certificate for Certificate Request Agent from "SmartCardEnrollment-Agent" template.
• Convert from cert.pem to pfx (esc3agent.pfx below) and use it to request a certificate on behalf of DA using the "SmartCardEnrollment-Users" template.
• Convert from cert.pem to pfx (esc3user-DA.pfx below), request DA TGT and inject it:
Escalation to EA • Convert from cert.pem to pfx (esc3agent.pfx below) and use it to request a certificate on behalf of EA using the "SmartCardEnrollment-Users" template.
• Request EA TGT and inject it:
ESC6
• The CA in moneycorp has EDITF_ATTRIBUTESUBJECTALTNAME2 flag set. This means that we can request a certificate for ANY user from a template that allow enrollment for normal/low-privileged users.
• The template "CA-Integration" grants enrollment to the RDPUsers group. Request a certificate for DA (or EA) as studentx
• Convert from cert.pem to pfx (esc6.pfx below) and use it to request a TGT for DA (or EA).
MS-SQL Servers Abuse
• Discovery (SPN Scanning)
• Check Accessibility
• Gather Information
• Look for links to remote servers
• Openquery() function can be used to run queries on a linked database
• Enumerating Database Links
or • Openquery queries can be chained to access links within links (nested links)
• Executing Commands
• Use the -QuertyTarget parameter to run Query on a specific instance (without -QueryTarget the command tries to use xp_cmdshell on every link of the chain)
• From the initial SQL server, OS commands can be executed using nested link queries:
• Reverse shell -
MDI Bypass
• The key is to avoid talking to the DC as long as possible and make appear the traffic we generate as attacker normal.
• To bypass DCSync detection, go for users which are whitelisted. For example, the user account used for PHS may be whitelisted.
• Also, if we have NTLM hash of a DC, we can extract NTLM hashes of any machine account using netsync
• If we forge a Golden Ticket with SID History of the Domain Controllers group and Enterprise Domain Controllers Group, there are less chances of detection by MDI
Protect and Limit Domain Admins
• Reduce the number of Domain Admins in your environment.
• Do not allow or limit login of DAs to any other machine other than the Domain Controllers. If logins to some servers is necessary, do not allow other administrators to login to that machine.
• (Try to) Never run a service with a DA. Credential theft protections which we are going to discuss soon are rendered useless in case of a service account.
• Set "Account is sensitive and cannot be delegated" for DAs.
Protected Users Group
• Protected Users is a group introduced in Server 2012 R2 for "better protection against credential theft" by not caching credentials in insecure ways. A user added to this group has following major device protections:
Cannot use CredSSP and WDigest - No more cleartext credentials caching.
NTLM hash is not cached.
Kerberos does not use DES or RC4 keys. No caching of clear text cred or long term keys.
• If the domain functional level is Server 2012 R2, following DC protections are available:
No NTLM authentication.
No DES or RC4 keys in Kerberos pre-auth.
No delegation (constrained or unconstrained)
No renewal of TGT beyond initial four hour lifetime - Hardcoded, unconfigurable Maximum lifetime for user ticket" and "Maximum lifetime for user ticket renewal"
• Needs all domain control to be at least Server 2008 or later (because AES keys).
• Not recommended by MS to add DAs and EAs to this group without testing "the potential impact" of lock out.
• No cached logon ie. no offline sign-on.
• Having computer and service accounts in this group is useless as their credentials will always be present on the host machine.
Isolate administrative workstations
Privileged Administrative Workstations (PAWs)
• A hardened workstation for performing sensitive tasks like administration of domain controllers, cloud infrastructure, sensitive business functions etc.
• Can provides protection from phishing attacks, OS vulnerabilities, credential replay attacks.
• Admin Jump servers to be accessed only from a PAW, multiple strategies
Separate privilege and hardware for administrative and normal tasks.
Having a VM on a PAW for user tasks.
Secure local administrators
LAPS (Local Administrator Password Solution)
• Centralized storage of passwords in AD with periodic randomizing where read permissions are access controlled. • Computer objects have two new attributes - ms-mcs-AdmPwd attribute stores the clear text password and ms-mcs-AdmPwdExpirationTime controls the password change.
• Storage in clear text, transmission is encrypted.
• Note - With careful enumeration, it is possible to retrieve which users can access the clear text password providing a list of attractive targets!
Time Bound Administration
Just In Time (JIT)
• Just In Time (JIT) administration provides the ability to grant time-bound administrative access on per-request bases.
• Check out Temporary Group Membership! (Requires Privileged Access Management Feature to be enabled which can't be turned off later)
Just Enough Administration (JEA)
• JEA (Just Enough Administration) provides role based access control for PowerShell based remote delegated administration.
• With JEA non-admin users can connect remotely to machines for doing specific administrative tasks.
• For example, we can control the command a user can run and even restrict parameters which can be used.
• JEA endpoints have PowerShell transcription and logging enabled.
Defenses
Active Directory Administrative Tier Model
• Composed of three levels only for administrative accounts:
Tier 0 - Accounts, Groups and computers which have privileges across the enterprise like domain controllers,domain admins, enterprise admins.
Tier 1 - Accounts, Groups and computers which have access to resources having significant amount of business value. A common example role is server administrators who maintain these operating systems with the ability to impact all enterprise services.
Tier 2 - Administrator accounts which have administrative control of a significant amount of business value that is hosted on user workstations and devices. Examples include Help Desk and computer support administrators because they can impact the integrity of almost any user data.
• Control Restrictions - What admins control.
• Logon Restrictions - Where admins can log-on to.
ESAE (Enhanced Security Admin Environment)
• Dedicated administrative forest for managing critical assets like administrative users, groups and computers.
• Since a forest is considered a security boundary rather than a domain, this model provides enhanced security controls.
• The administrative forest is also called the Red Forest.
• Administrative users in a production forest are used as standard non-privileged users in the administrative forest.
• Selective Authentication to the Red Forest enables stricter security controls on logon of users from non-administrative forests.
• Microsoft retired ESAE in 2021 and replaced it with Privileged Access Strategy but it is still worth discussing.
Credential Guard
• It "uses virtualization-based security to isolate secrets so that only privileges system software can access them".
• But, credentials for local accounts in SAM and Service account credentials from LSA Secrets are NOT protected.
• Credential Guard cannot be enabled on a domain controller as it breaks authentication there.
• Only available on the Windows 10+ Enterprise edition and Server 2016/later.
• Mimikatz can bypass it but still, no need to not use it.
Device Guard (WDAC)
• It is a group of features "designed to harden a system against malware attacks. Its focus is preventing malicious code from running by ensuring only known good code can run."
• Three primary components:
Configurable Code Integrity (CCI) - Configure only trusted code to run
Virtual Secure Mode Protected Code Integirty - Enforces CCI with Kernerl Mode (KMCI) and UserMode (UMCI)
Platform and UEFI Secure Boot - Ensures boot binaries and firmware integrity
• UMCI is something which interferes with most of the lateral movement attacks we have seen.
• While it depends on the deployment (discussing which will be too lengthy), many well known application whitelisting bypasses - signed binaries like csc.exe, MSBuild.exe etc. - are useful for bypassing UMCI as well.
• Check out the LOLBAS project (lolbas-project.github.io/).
MDI
• "..identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization."
• MDI sensors are installed on DCs and Federation servers. Analysis and alerting is done in the Azure cloud.
• MDI can be used for detecting
Recon
Compromised credentials (Brute-Force, Kerberoasting etc.)
Lateral movement (PTH, OPTH etc.)
Domain Dominance (DCSync, Golden ticket, Skeleton key etc.)
Exfiltration
Deceptions
• Deception is a very effective technique in active directory defense.
• By using decoy domain objects, defenders can trick adversaries to follow a particular attack path which increases chances of detection and increase their cost in terms of time.
• Traditionally, deception has been limited to leave honey credentials on some boxes and check their usage but we can use it effectively during other phases of an attack.
• What to target? --> Adversary mindset of going for the "lowest hanging fruit" and illusive superiority over defenders.
• We must provide the adversaries what they are looking for. For example, what adversaries look for in a user object:
A user with high privileges.
Permissions over other objects.
Poorly configured ACLs.
Misconfigured/dangerous user attributes and so on.
• Note that Windows Settings|Security Settings|Advanced Audit Policy Configuration|DS Access|Audit Directory Service Access Group Policy needs to be configured to enable 4662 logging.
User Deception
• Creates a decoy user whose password never expires and a 4662 is logged whenever x500uniqueIdentifier - d07da11f-8a3d-42b6-b0aa-76c962be719a property of the user is read.:
• This property is not read by net.exe, WMI classes (like Win32_UserAccount) and ActiveDirectory module. But LDAP based tools like PowerView and ADExplorer trigger the logging.
• Create a decoy user named decda and make it a member of the Domain Admins group. As a protection against potential abuse, Deny logon to the user on any machine.
• If there is any attempt to use the user credentials (password or hashes) a 4768 is logged.
• Any enumeration which reads DACL or all properties for the user will result in a 4662 logging.
Detections
Golden Ticket
• Event IDs
4624: Account Logon
4672: Admin Logon
Silver Ticket
• Event IDs
4624: Account Logon
4634: Account Logoff
4672: Admin Logon
Skeleton Key
• Event IDs
7045 - A service was installed in the system. (Type Kernel Mode driver)
4673 - Sensitive Privilege Use
4611 - A trusted logon process has been registered with the Local Security Authority
"Audit privilege use" must be enabled
• Not recommended:
• Mitigation
Running lsass.exe as a protected process is really handy as it forces an attacker to load a kernel mode driver.
Make sure that you test it thoroughly as many drivers and plugins may not load with the protection.
• Verify after a reboot
DSRM
• Events
Event ID 4657 - Audit creation/change of
HKLM:\System\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior
Malicious SSP
• Events
Event ID 4657 - Audit creation/change of
HKLM:\System\CurrentControlSet\Control\Lsa\SecurityPackages
Kerberoasting
• Events
Security Event ID 4769 - A Kerberos ticket was requested
• Mitigation
Service Account Passwords should be hard to guess (greater than 35 characters)
Use Group Managed Service Accounts (Automatic change of password periodically and delegated SPN Management)
• Since 4769 is logged very frequently on a DC. We may like to filter results based on the following information from logs:
Service name should not be krbtgt
Service name does not end with $ (to filter out machine accounts used for services)
Account name should not be machine@domain (to filter out requests from machines)
Failure code is '0x0' (to filter out failures, 0x0 is success)
Most importantly, ticket encryption type is 0x17
ACL Attacks
• Events
Security Event ID 4662 (Audit Policy for object must be enabled) - An operation was performed on an object
Security Event ID 5136 (Audit Policy for object must be enabled) - A directory service object was modified
Security Event ID 4670 (Audit Policy for object must be enabled) - Permissions on an object were changed
Trust Tickets
• SID Filtering
• Avoid attacks which abuse SID history attribute (child to root domain privilege escalation, that is, DA from a Child to EA on forest root). • Enabled by default on all inter-forest trusts. Intra-forest trusts are assumed secured by default (MS considers forest and not the domain to be a security boundary).
• But, since SID filtering has potential to break applications and user access, it is often disabled.
Selective Authentication
• In an inter-forest trust, if Selective Authentication is configured, users between the trusts will not be automatically authenticated. Individual access to domains and servers in the trusting domain/forest should be given.
Recommended Readings
• Securing Privileged Access:
• Best Practices for Securing Active Directory:
Last updated