Derbycon - The Unintended Risks of Trusting Active Directory

Will Schroeder
Will SchroederOffensive Engineer
The Unintended Risks
of Trusting Active
Directory
@harmj0y
Red teamer and offensive engineer
at SpecterOps
Adaptive Threat Division alumni
Avid blogger (http://harmj0y.net)
Co-founder of GhostPack, Empire,
BloodHound, Veil-Framework
2
@tifkin_
Red teamer, hunter, and
researcher at SpecterOps
Adaptive Threat Division alumni
Forever going after shiny things
Contributor to various
projects/blog posts
3
@enigma0x3
Red teamer and security
researcher at SpecterOps
Adaptive Threat Division alumni
Avid blogger
(https://enigma0x3.net/), COM
lover, CVE holder
4
What is
“Admin Access” ?
Hint: it’s more complicated
than just “local administrators”!
5
The “True” Nature of Administrative Access
▪ Controversial statement: membership in a system’s
local administrators group isn’t what ultimately
matters!
▪ What actually matters is what local/domain groups
have access to specific remote resources (RPC,
remote reg, WMI, SQL, etc.) based on the host
service’s security descriptors
6
7
CIFS
Remote
Registry
WinRM
SCM
WMI
RPC :)
SD
SD
“LOCAL
Administrators”
GENERIC_ALL
“DOMAINuser”
SC_MANAGER_C
REATE_SERVICE
Etc.
SD
SD
SD
SD
Wait, Security
Descriptors? ACLs?
What are Those and Why Should I Care?
8
Security descriptors are the
Windows mechanism to control
authenticated access to
resources, or “securable objects”
9
PS: lots of caveats here :)
What Is a
“Securable Object”?
Why, a Windows object that can have
a security descriptor, of course!
10
SECURITY_DESCRIPTOR
11https://msdn.microsoft.com/en-us/library/windows/hardware/ff556610(v=vs.85).aspx
From Owners to DACLs to ACEs
▪ An object’s Owner completely controls an object
▪ An object’s Discretionary Access Control List
(DACL) is collection of Access Control Entries
(ACEs)
▫ ACEs – Allow/Deny rules of who can do what to an object
12
13
Authorization Checks
▪ Individual services perform authorization checks
when objects are accessed
▪ Services compare the requestor’s user/group SIDs
to the DACL and grant/deny access
▪ Local “Administrators” is a group many services
grant access to by default (but it could be denied)
14
OK, That’s “Cool”
but Why Should I
Care, Really?
15
Why Care?
▪ It’s often difficult to determine whether a specific security
descriptor misconfiguration was set maliciously or configured
by accident
▫ Existing misconfigurations: privesc/lateral movement opportunities
▫ Malicious misconfiguration changes: persistence!
▪ These changes often have a minimal forensic footprint
▪ Many teams are not aware of these misconfigurations, much
less how to identify, abuse, or remediate them
16
Host-based Security
Descriptors
More than just the service control manager yo’
Discovering Host Securable Objects
▪ Windows documentation lists about 20-30 securable
objects*
▪ We’ve identified 70+! (There are *many* more)
▪ Microsoft Protocol Specifications
▫ Very useful for RPC servers ;)
▪ Find-RegistrySecurityDescriptors.ps1
▪ @tiraniddo’s NtObjectManager project
18*https://msdn.microsoft.com/en-us/library/windows/desktop/aa379557(v=vs.85).aspx
19
Persistent vs Runtime Security Descriptors
▪ Where do objects get their security descriptor?
▫ Persistent - Security descriptor loaded from registry, file, etc.
▫ Runtime - Security descriptor is in memory
▪ Our approach for enumeration:
▫ Locally as an unprivileged user
▫ Locally as a privileged user
▫ Remotely as an unprivileged user
▫ Remotely as a privileged user
20
Example: Remote Registry
▪ Imagine this scenario: remotely dumping an
endpoint’s machine account hash as an “unprivileged”
user (i.e. not in local admins)!
▪ Backdoor Process
▫ Remotely backdoor the winreg key with an attacker-
controlled user/group (this key == remote registry access)
▫ Add malicious ACEs to a few specific registry hives/keys so
we can read LSA secrets remotely
21
Example: Remote Registry
▪ (Remote) Backdoor Execution
▫ As the backdoor (domain or local) user, connect to the
remote registry service on the backdoored system
▫ Open up specific reg keys linked to LSA and extract their
classes
▫ Combine these class values and compute the BootKey
▫ Use the BootKey to decrypt the LSA key
▫ Use the LSA key to decrypt the machine account hash!
▫ EVERYONE GETS A SILVER TICKET!!
22
Active Directory Security
Descriptors
Everything needs an access control model, even AD
Active Directory ACL Advantages
24
▪ A big advantage: by default the DACLs for nearly
every AD object can be enumerated by any
authenticated user in the domain through LDAP!
▪ Other advantages of AD ACLs:
▫ Changes also have a minimal forensic footprint
▫ Changes often survive OS and domain functional level
upgrades, i.e. “misconfiguration debt”
▫ Anti-audit measures can be taken!
25
Security
Descriptors:
AD GUI
Edition
Generic Rights We Care About
26
GenericAll Allows ALL generic rights to the specified object
GenericWrite Allows for the modification of (almost) all
properties on a specified object
WriteDacl Grants the ability to modify the DACL in the
object security descriptor
WriteOwner Grants the ability to take ownership of the object
Object-specific Rights We Care About (abbreviated)
27
Users User-Force-Change-Password or write to
the servicePrincipalName
Groups Write to the member property
Computers None outside of LAPS :(
GPOs Modification of GPC-File-Sys-Path
Domains WriteDacl to add DCSync rights
Example: Abusing Exchange
▪ Exchange Server introduces several schema changes,
new nested security groups, and MANY control
relationships to Active Directory, making it a perfect
spot to blend in amongst the noise!
▪ Pre Exchange Server 2007 SP1, this included the
WriteDACL privilege against the domain object itself
with Exchange Trusted Subsystem as the principal
28
Active Directory + Host
ACL Abuse
Plugging the Gaps in Attack Chains
▪ Prior to joining active directory, the host is in ultimate
control of who can access its resources
▪ After a machine is joined to AD, a few things happen:
▫ The machine is no longer solely in charge of authentication
▫ A portion of key material for the host is stored in another
location (machine account hash in ntds.dit)
▫ Default domain group SIDs are added to local groups
▫ Management is no longer solely left to the host (i.e. GPOs :)
“Risks” Of Joining Active Directory
30
Active Directory: Before and After
31
Workgroup
Security Principals Local users/groups
Access/Permission
Management
Host-based Security
Descriptors
Authentication NTLM (SAM)
Resource
Administration
Manual
Active Directory
+ Domain users/groups
+ Default domain groups
added to local groups
+ Kerberos/NTLM
(NTDS)
+ GPOs
Active Directory: Before and After
32
DCOM
Service
Administrators
admin
DOMAINDomain Admins
Distributed
COM Users
DOMAINsrvcacct
DOMAINjohnDOMAINsrvadms
DOMAINlee
Security Implications
▪ Host-based security descriptors are the missing
link when thinking about domain attack graphs!
▪ There ARE existing “misconfigurations” in the security
descriptors in some host-based services!
▫ More to come on this in a bit ;)
▪ Host-based security descriptor modifications can be
chained with AD misconfigurations/modifications
▪ “Fills the gap” left by the lack of an AD ACL computer primitive
33
tl;dr Security Implications of Joining Active Directory
▪ When you join a system to Active Directory, you’re
introducing additional nodes into the access graph
that may affect the security of other systems
▪ You’re also implicitly trusting the security of a
large number of other nodes in the graph as well
▫ You’re almost certainly exposing your system’s services
to more access than you realize!
34
Case Study #1
Picking on Exchange Again :)
Case Study: Exchanging Rights
▪ We saw before that the Exchange Trusted
Subsystem group (which contains Exchange servers)
often has a huge number of rights over the domain
▪ So let’s integrate the remote registry host-based
backdoor on an Exchange box!
▫ No changes to the DC or any AD data
▫ Takes advantage of existing misconfigurations!
36
37
Case Study #2
Abusing Existing Misconfigurations
Ingredient #1: Unconstrained Delegation
▪ If a server is configured for unconstrained
delegation, service ticket requests will include the
requestor’s TGT stuffed into the service ticket
▪ So if you can get a principal to auth to an
unconstrained server you control, you can
extract their TGTs out of memory!
▪ More information: https://adsecurity.org/?p=1667
39
Ingredient #2: Effectively Extracting TGTs
▪ Rubeus is a new C# Kerberos abuse toolkit that
includes various ticket extraction capabilities
▪ The monitor action will monitor 4624 logon events
from the event log and extract any new usable
TGT .kirbis from LSASS using LSA APIs
▫ No read handle to LSASS needed!
40https://github.com/GhostPack/Rubeus
Ingredient #3: The Printer Bug
▪ Old but enabled-by-default-on-Windows Print
System Remote Protocol (MS-RPRN)
▪ RpcRemoteFindFirstPrinterChangeNotification(Ex)
▫ Purpose: “REMOTESERVER, send me a notification when
____” (e.g. when there’s a new print job)
▪ Implication: *Any domain user* can coerce
REMOTESERVER$ to authenticate to any machine
▫ Won’t fix by Microsoft - “ by design” ☺
41
Ingredient #3: The Printer Bug
42
Domain User/Attacker: Please authenticate to OTHERHOST
SERVER
OTHERHOST
Abuse Scenarios
▪ Machine account TGT theft via Unconstrained Delegation
▪ NTLM attacks!!!!
▪ NTLM-relay to ______ protocol
▪ Is SERVER$ local admin anywhere? (Relay and login)
▪ LDAP relay anyone…. ☺
▪ NTLMv1 downgrade attacks - XP/2003 anyone?
The Dangerous Recipe
1. Compromise a server configured with
unconstrained delegation
2. Beginning monitoring for delegated TGTs
▫ Start Rubeus’ monitor action with /interval:5
3. Coerce a domain controller to authenticate to the
unconstrained server using SpoolSample
4. Load the extracted ticket, DCSync, profit!
43
44
45
Summary
▪ Access is more than just “local administrators” !
▪ Host based security descriptors (accidentally misconfigured,
configured by default, or maliciously backdoored) can have
far-reaching implications for the security of other
systems in the domain!
▪ Defense should focus on restricting access to ALL securable
objects (host, AD, Exchange, etc.)
46
Questions?
You can find us at @SpecterOps:
▪ @harmj0y , @tifkin_ ,
@enigma0x3
▪ [will,lee,matt]@specterops.io
Credit to @elad_shamir for subsequent
discovery of the printer bug!
Appendix: Printer Bug Details
▪ Print System Remote Protocol (MS-RPRN)
▫ All comms are SMB-RPC (TCP 445)
▫ Named Pipe: pipespoolss
▫ RPC UUID: 12345678-1234-ABCD-EF00-0123456789AB
▫ “Discovered” by reading the protocol spec (likely more
RPC servers that do a similar thing)
47
Appendix: Printer Bug Details
▪ Opnum 62 or 65
▫ RpcRemoteFindFirstPrinterChangeNotification
▫ RpcRemoteFindFirstPrinterChangeNotificationEx
▪ The RPC server is accessible by all domain users
on Windows >= 8 if the Spooler service is started
(Server & Workstations have it enabled by default)
▫ On Windows < 8 , seems possible if the host has
shared a printer
48
Appendix: Coerced Machine Account Authentication
Attack Scenarios
▪ Printer bug isn’t the only way to do this (we’ve already confirmed from
our own research/other that there’s other vectors)
▪ If NTLMv1 enabled? Do an NTLMv1 downgrade and get the machine’s
NTLM hash
▪ NTLM relay
▫ Is a machine account a member of the local Administrators group on any
machine? (Often seen on SCCM and Exchange servers)
▫ NTLM relay to LDAP and grant yourself DCSync rights if LDAP signing not
enforced (see @_dirkjan’s contribution to ntlmrelayx)
▫ Problematic with SMB -> LDAP due to SMB clients setting the signing
bit (thanks @_dirkjan!)
49
Hi Lee,
The team has finished its investigation and determined the issue is by-design.
From the NTLM side of things, this is a relay attack, and there are plenty of mitigations that customers can
use to mitigate this particular attack:
1. Restrict NTLM usage
2. Configure/enable Extended Protection for Authentication for all services that support it.
3. Enable SMB Signing or SMB Encryption
4. Do not grant machine accounts administrative privileges to other machine accounts
50
Additional Guidance
▪ Impersonating domain machine accounts is by design? ¯_(ツ)_/¯
▫ We don’t think it was, but nonetheless, it’s possible
▪ Restricting access to hosts/networks goes a LONG way
▫ Windows does not require inbound network access in order to work
in Active Directory!
▫ FIREWALLS!! Host-based and network
▫ IPSec
▪ Prevent relaying to LDAP: Set LdapEnforceChannelBinding to 1
51
1 of 51

Recommended

aclpwn - Active Directory ACL exploitation with BloodHound by
aclpwn - Active Directory ACL exploitation with BloodHoundaclpwn - Active Directory ACL exploitation with BloodHound
aclpwn - Active Directory ACL exploitation with BloodHoundDirkjanMollema
11.5K views41 slides
DerbyCon 2019 - Kerberoasting Revisited by
DerbyCon 2019 - Kerberoasting RevisitedDerbyCon 2019 - Kerberoasting Revisited
DerbyCon 2019 - Kerberoasting RevisitedWill Schroeder
10.3K views27 slides
0wn-premises: Bypassing Microsoft Defender for Identity by
0wn-premises: Bypassing Microsoft Defender for Identity0wn-premises: Bypassing Microsoft Defender for Identity
0wn-premises: Bypassing Microsoft Defender for IdentityNikhil Mittal
1.6K views26 slides
Abusing Microsoft Kerberos - Sorry you guys don't get it by
Abusing Microsoft Kerberos - Sorry you guys don't get itAbusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get itBenjamin Delpy
43.1K views53 slides
Ace Up the Sleeve by
Ace Up the SleeveAce Up the Sleeve
Ace Up the SleeveWill Schroeder
23.7K views60 slides
PSConfEU - Offensive Active Directory (With PowerShell!) by
PSConfEU - Offensive Active Directory (With PowerShell!)PSConfEU - Offensive Active Directory (With PowerShell!)
PSConfEU - Offensive Active Directory (With PowerShell!)Will Schroeder
9K views16 slides

More Related Content

What's hot

Fantastic Red Team Attacks and How to Find Them by
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemRoss Wolf
895 views88 slides
Not a Security Boundary by
Not a Security BoundaryNot a Security Boundary
Not a Security BoundaryWill Schroeder
4K views48 slides
(Ab)Using GPOs for Active Directory Pwnage by
(Ab)Using GPOs for Active Directory Pwnage(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory PwnagePetros Koutroumpis
563 views53 slides
The Unintended Risks of Trusting Active Directory by
The Unintended Risks of Trusting Active DirectoryThe Unintended Risks of Trusting Active Directory
The Unintended Risks of Trusting Active DirectoryWill Schroeder
8.4K views46 slides
Hunting for Privilege Escalation in Windows Environment by
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
11.9K views99 slides
Introduction to red team operations by
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
1.3K views66 slides

What's hot(20)

Fantastic Red Team Attacks and How to Find Them by Ross Wolf
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
Ross Wolf895 views
The Unintended Risks of Trusting Active Directory by Will Schroeder
The Unintended Risks of Trusting Active DirectoryThe Unintended Risks of Trusting Active Directory
The Unintended Risks of Trusting Active Directory
Will Schroeder8.4K views
Hunting for Privilege Escalation in Windows Environment by Teymur Kheirkhabarov
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov11.9K views
Introduction to red team operations by Sunny Neo
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
Sunny Neo1.3K views
SpecterOps Webinar Week - Kerberoasting Revisisted by Will Schroeder
SpecterOps Webinar Week - Kerberoasting RevisistedSpecterOps Webinar Week - Kerberoasting Revisisted
SpecterOps Webinar Week - Kerberoasting Revisisted
Will Schroeder3.7K views
Red Team Methodology - A Naked Look by Jason Lang
Red Team Methodology - A Naked LookRed Team Methodology - A Naked Look
Red Team Methodology - A Naked Look
Jason Lang14.7K views
Catch Me If You Can: PowerShell Red vs Blue by Will Schroeder
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs Blue
Will Schroeder7.8K views
Here Be Dragons: The Unexplored Land of Active Directory ACLs by Andy Robbins
Here Be Dragons: The Unexplored Land of Active Directory ACLsHere Be Dragons: The Unexplored Land of Active Directory ACLs
Here Be Dragons: The Unexplored Land of Active Directory ACLs
Andy Robbins6.2K views
Evading Microsoft ATA for Active Directory Domination by Nikhil Mittal
Evading Microsoft ATA for Active Directory DominationEvading Microsoft ATA for Active Directory Domination
Evading Microsoft ATA for Active Directory Domination
Nikhil Mittal35.4K views
COM Hijacking Techniques - Derbycon 2019 by David Tulis
COM Hijacking Techniques - Derbycon 2019COM Hijacking Techniques - Derbycon 2019
COM Hijacking Techniques - Derbycon 2019
David Tulis5.7K views
PowerShell for Practical Purple Teaming by Nikhil Mittal
PowerShell for Practical Purple TeamingPowerShell for Practical Purple Teaming
PowerShell for Practical Purple Teaming
Nikhil Mittal5.3K views
Level Up! - Practical Windows Privilege Escalation by jakx_
Level Up! - Practical Windows Privilege EscalationLevel Up! - Practical Windows Privilege Escalation
Level Up! - Practical Windows Privilege Escalation
jakx_3.5K views
Windows Privilege Escalation by Riyaz Walikar
Windows Privilege EscalationWindows Privilege Escalation
Windows Privilege Escalation
Riyaz Walikar15.2K views
Getting Started in Pentesting the Cloud: Azure by Beau Bullock
Getting Started in Pentesting the Cloud: AzureGetting Started in Pentesting the Cloud: Azure
Getting Started in Pentesting the Cloud: Azure
Beau Bullock2.2K views
Carlos García - Pentesting Active Directory Forests [rooted2019] by RootedCON
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]
RootedCON4.5K views
Hunting for Credentials Dumping in Windows Environment by Teymur Kheirkhabarov
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
Teymur Kheirkhabarov15.3K views

Similar to Derbycon - The Unintended Risks of Trusting Active Directory

Gartner Security & Risk Management Summit 2018 by
Gartner Security & Risk Management Summit 2018Gartner Security & Risk Management Summit 2018
Gartner Security & Risk Management Summit 2018Paula Januszkiewicz
3.3K views64 slides
Enterprise Cloud Security by
Enterprise Cloud SecurityEnterprise Cloud Security
Enterprise Cloud SecurityMongoDB
232 views41 slides
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defense by
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defenseDEF CON 23 - Sean - metcalf - red vs blue ad attack and defense
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defenseFelipe Prado
83 views81 slides
Securing Your MongoDB Deployment by
Securing Your MongoDB DeploymentSecuring Your MongoDB Deployment
Securing Your MongoDB DeploymentMongoDB
4.3K views32 slides
Mitigating Java Deserialization attacks from within the JVM (improved version) by
Mitigating Java Deserialization attacks from within the JVM (improved version)Mitigating Java Deserialization attacks from within the JVM (improved version)
Mitigating Java Deserialization attacks from within the JVM (improved version)Apostolos Giannakidis
351 views41 slides
I got 99 trends and a # is all of them by
I got 99 trends and a # is all of themI got 99 trends and a # is all of them
I got 99 trends and a # is all of themRoberto Suggi Liverani
5.8K views122 slides

Similar to Derbycon - The Unintended Risks of Trusting Active Directory(20)

Gartner Security & Risk Management Summit 2018 by Paula Januszkiewicz
Gartner Security & Risk Management Summit 2018Gartner Security & Risk Management Summit 2018
Gartner Security & Risk Management Summit 2018
Paula Januszkiewicz3.3K views
Enterprise Cloud Security by MongoDB
Enterprise Cloud SecurityEnterprise Cloud Security
Enterprise Cloud Security
MongoDB232 views
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defense by Felipe Prado
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defenseDEF CON 23 - Sean - metcalf - red vs blue ad attack and defense
DEF CON 23 - Sean - metcalf - red vs blue ad attack and defense
Felipe Prado83 views
Securing Your MongoDB Deployment by MongoDB
Securing Your MongoDB DeploymentSecuring Your MongoDB Deployment
Securing Your MongoDB Deployment
MongoDB4.3K views
Mitigating Java Deserialization attacks from within the JVM (improved version) by Apostolos Giannakidis
Mitigating Java Deserialization attacks from within the JVM (improved version)Mitigating Java Deserialization attacks from within the JVM (improved version)
Mitigating Java Deserialization attacks from within the JVM (improved version)
Operations: Security Crash Course — Best Practices for Securing your Company by Amazon Web Services
Operations: Security Crash Course — Best Practices for Securing your CompanyOperations: Security Crash Course — Best Practices for Securing your Company
Operations: Security Crash Course — Best Practices for Securing your Company
Thick Application Penetration Testing: Crash Course by Scott Sutherland
Thick Application Penetration Testing: Crash CourseThick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash Course
Scott Sutherland16.7K views
Mitigating Java Deserialization attacks from within the JVM by Apostolos Giannakidis
Mitigating Java Deserialization attacks from within the JVMMitigating Java Deserialization attacks from within the JVM
Mitigating Java Deserialization attacks from within the JVM
Carlos García - Pentesting Active Directory [rooted2018] by RootedCON
Carlos García - Pentesting Active Directory [rooted2018]Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]
RootedCON11.6K views
DataStax | Best Practices for Securing DataStax Enterprise (Matt Kennedy) | C... by DataStax
DataStax | Best Practices for Securing DataStax Enterprise (Matt Kennedy) | C...DataStax | Best Practices for Securing DataStax Enterprise (Matt Kennedy) | C...
DataStax | Best Practices for Securing DataStax Enterprise (Matt Kennedy) | C...
DataStax1K views
Securing Applications and Pipelines on a Container Platform by All Things Open
Securing Applications and Pipelines on a Container PlatformSecuring Applications and Pipelines on a Container Platform
Securing Applications and Pipelines on a Container Platform
All Things Open929 views
Managed Threat Detection & Response for AWS Applications by Alert Logic
Managed Threat Detection & Response for AWS ApplicationsManaged Threat Detection & Response for AWS Applications
Managed Threat Detection & Response for AWS Applications
Alert Logic 2K views
Jesse Burke RDPwned HackMiami7 by Jesse Burke
Jesse Burke RDPwned HackMiami7Jesse Burke RDPwned HackMiami7
Jesse Burke RDPwned HackMiami7
Jesse Burke977 views
Creating a fortress in your active directory environment by David Rowe
Creating a fortress in your active directory environmentCreating a fortress in your active directory environment
Creating a fortress in your active directory environment
David Rowe531 views
Securing Your Enterprise Web Apps with MongoDB Enterprise by MongoDB
Securing Your Enterprise Web Apps with MongoDB Enterprise Securing Your Enterprise Web Apps with MongoDB Enterprise
Securing Your Enterprise Web Apps with MongoDB Enterprise
MongoDB823 views
Active Directory and Virtualization by Aniket Pandey
Active Directory and VirtualizationActive Directory and Virtualization
Active Directory and Virtualization
Aniket Pandey341 views
Tips to Remediate your Vulnerability Management Program by BeyondTrust
Tips to Remediate your Vulnerability Management ProgramTips to Remediate your Vulnerability Management Program
Tips to Remediate your Vulnerability Management Program
BeyondTrust736 views

More from Will Schroeder

Nemesis - SAINTCON.pdf by
Nemesis - SAINTCON.pdfNemesis - SAINTCON.pdf
Nemesis - SAINTCON.pdfWill Schroeder
238 views32 slides
Certified Pre-Owned by
Certified Pre-OwnedCertified Pre-Owned
Certified Pre-OwnedWill Schroeder
1.5K views30 slides
An ACE in the Hole - Stealthy Host Persistence via Security Descriptors by
An ACE in the Hole - Stealthy Host Persistence via Security DescriptorsAn ACE in the Hole - Stealthy Host Persistence via Security Descriptors
An ACE in the Hole - Stealthy Host Persistence via Security DescriptorsWill Schroeder
6.9K views63 slides
Defending Your "Gold" by
Defending Your "Gold"Defending Your "Gold"
Defending Your "Gold"Will Schroeder
2.3K views20 slides
A Case Study in Attacking KeePass by
A Case Study in Attacking KeePassA Case Study in Attacking KeePass
A Case Study in Attacking KeePassWill Schroeder
9.9K views50 slides
The Travelling Pentester: Diaries of the Shortest Path to Compromise by
The Travelling Pentester: Diaries of the Shortest Path to CompromiseThe Travelling Pentester: Diaries of the Shortest Path to Compromise
The Travelling Pentester: Diaries of the Shortest Path to CompromiseWill Schroeder
9.1K views45 slides

More from Will Schroeder(20)

An ACE in the Hole - Stealthy Host Persistence via Security Descriptors by Will Schroeder
An ACE in the Hole - Stealthy Host Persistence via Security DescriptorsAn ACE in the Hole - Stealthy Host Persistence via Security Descriptors
An ACE in the Hole - Stealthy Host Persistence via Security Descriptors
Will Schroeder6.9K views
A Case Study in Attacking KeePass by Will Schroeder
A Case Study in Attacking KeePassA Case Study in Attacking KeePass
A Case Study in Attacking KeePass
Will Schroeder9.9K views
The Travelling Pentester: Diaries of the Shortest Path to Compromise by Will Schroeder
The Travelling Pentester: Diaries of the Shortest Path to CompromiseThe Travelling Pentester: Diaries of the Shortest Path to Compromise
The Travelling Pentester: Diaries of the Shortest Path to Compromise
Will Schroeder9.1K views
Trusts You Might Have Missed - 44con by Will Schroeder
Trusts You Might Have Missed - 44conTrusts You Might Have Missed - 44con
Trusts You Might Have Missed - 44con
Will Schroeder5.6K views
Building an EmPyre with Python by Will Schroeder
Building an EmPyre with PythonBuilding an EmPyre with Python
Building an EmPyre with Python
Will Schroeder4.7K views
PSConfEU - Building an Empire with PowerShell by Will Schroeder
PSConfEU - Building an Empire with PowerShellPSConfEU - Building an Empire with PowerShell
PSConfEU - Building an Empire with PowerShell
Will Schroeder3.3K views
I Have the Power(View) by Will Schroeder
I Have the Power(View)I Have the Power(View)
I Have the Power(View)
Will Schroeder20.8K views
Building an Empire with PowerShell by Will Schroeder
Building an Empire with PowerShellBuilding an Empire with PowerShell
Building an Empire with PowerShell
Will Schroeder22.3K views
Trusts You Might Have Missed by Will Schroeder
Trusts You Might Have MissedTrusts You Might Have Missed
Trusts You Might Have Missed
Will Schroeder4.6K views
Drilling deeper with Veil's PowerTools by Will Schroeder
Drilling deeper with Veil's PowerToolsDrilling deeper with Veil's PowerTools
Drilling deeper with Veil's PowerTools
Will Schroeder6.3K views
Derbycon - Passing the Torch by Will Schroeder
Derbycon - Passing the TorchDerbycon - Passing the Torch
Derbycon - Passing the Torch
Will Schroeder7.9K views
Adventures in Asymmetric Warfare by Will Schroeder
Adventures in Asymmetric WarfareAdventures in Asymmetric Warfare
Adventures in Asymmetric Warfare
Will Schroeder2.8K views
PowerUp - Automating Windows Privilege Escalation by Will Schroeder
PowerUp - Automating Windows Privilege EscalationPowerUp - Automating Windows Privilege Escalation
PowerUp - Automating Windows Privilege Escalation
Will Schroeder15.9K views

Recently uploaded

zotabet.pdf by
zotabet.pdfzotabet.pdf
zotabet.pdfzotabetcasino
6 views1 slide
Is Entireweb better than Google by
Is Entireweb better than GoogleIs Entireweb better than Google
Is Entireweb better than Googlesebastianthomasbejan
12 views1 slide
Existing documentaries (1).docx by
Existing documentaries (1).docxExisting documentaries (1).docx
Existing documentaries (1).docxMollyBrown86
13 views5 slides
DU Series - Day 4.pptx by
DU Series - Day 4.pptxDU Series - Day 4.pptx
DU Series - Day 4.pptxUiPathCommunity
100 views28 slides
UiPath Document Understanding_Day 3.pptx by
UiPath Document Understanding_Day 3.pptxUiPath Document Understanding_Day 3.pptx
UiPath Document Understanding_Day 3.pptxUiPathCommunity
101 views25 slides
𝐒𝐨𝐥𝐚𝐫𝐖𝐢𝐧𝐝𝐬 𝐂𝐚𝐬𝐞 𝐒𝐭𝐮𝐝𝐲 by
𝐒𝐨𝐥𝐚𝐫𝐖𝐢𝐧𝐝𝐬 𝐂𝐚𝐬𝐞 𝐒𝐭𝐮𝐝𝐲𝐒𝐨𝐥𝐚𝐫𝐖𝐢𝐧𝐝𝐬 𝐂𝐚𝐬𝐞 𝐒𝐭𝐮𝐝𝐲
𝐒𝐨𝐥𝐚𝐫𝐖𝐢𝐧𝐝𝐬 𝐂𝐚𝐬𝐞 𝐒𝐭𝐮𝐝𝐲Infosec train
9 views6 slides

Recently uploaded(20)

Existing documentaries (1).docx by MollyBrown86
Existing documentaries (1).docxExisting documentaries (1).docx
Existing documentaries (1).docx
MollyBrown8613 views
UiPath Document Understanding_Day 3.pptx by UiPathCommunity
UiPath Document Understanding_Day 3.pptxUiPath Document Understanding_Day 3.pptx
UiPath Document Understanding_Day 3.pptx
UiPathCommunity101 views
𝐒𝐨𝐥𝐚𝐫𝐖𝐢𝐧𝐝𝐬 𝐂𝐚𝐬𝐞 𝐒𝐭𝐮𝐝𝐲 by Infosec train
𝐒𝐨𝐥𝐚𝐫𝐖𝐢𝐧𝐝𝐬 𝐂𝐚𝐬𝐞 𝐒𝐭𝐮𝐝𝐲𝐒𝐨𝐥𝐚𝐫𝐖𝐢𝐧𝐝𝐬 𝐂𝐚𝐬𝐞 𝐒𝐭𝐮𝐝𝐲
𝐒𝐨𝐥𝐚𝐫𝐖𝐢𝐧𝐝𝐬 𝐂𝐚𝐬𝐞 𝐒𝐭𝐮𝐝𝐲
Infosec train9 views
IETF 118: Starlink Protocol Performance by APNIC
IETF 118: Starlink Protocol PerformanceIETF 118: Starlink Protocol Performance
IETF 118: Starlink Protocol Performance
APNIC186 views
AI Powered event-driven translation bot by Jimmy Dahlqvist
AI Powered event-driven translation botAI Powered event-driven translation bot
AI Powered event-driven translation bot
Jimmy Dahlqvist16 views
Opportunities for Youth in IG - Alena Muravska RIPE NCC.pdf by RIPE NCC
Opportunities for Youth in IG - Alena Muravska RIPE NCC.pdfOpportunities for Youth in IG - Alena Muravska RIPE NCC.pdf
Opportunities for Youth in IG - Alena Muravska RIPE NCC.pdf
RIPE NCC9 views
IGF UA - Dialog with I_ organisations - Alena Muavska RIPE NCC.pdf by RIPE NCC
IGF UA - Dialog with I_ organisations - Alena Muavska RIPE NCC.pdfIGF UA - Dialog with I_ organisations - Alena Muavska RIPE NCC.pdf
IGF UA - Dialog with I_ organisations - Alena Muavska RIPE NCC.pdf
RIPE NCC15 views
google forms survey (1).pptx by MollyBrown86
google forms survey (1).pptxgoogle forms survey (1).pptx
google forms survey (1).pptx
MollyBrown8614 views
Building trust in our information ecosystem: who do we trust in an emergency by Tina Purnat
Building trust in our information ecosystem: who do we trust in an emergencyBuilding trust in our information ecosystem: who do we trust in an emergency
Building trust in our information ecosystem: who do we trust in an emergency
Tina Purnat92 views
We see everywhere that many people are talking about technology.docx by ssuserc5935b
We see everywhere that many people are talking about technology.docxWe see everywhere that many people are talking about technology.docx
We see everywhere that many people are talking about technology.docx
ssuserc5935b6 views
Serverless cloud architecture patterns by Jimmy Dahlqvist
Serverless cloud architecture patternsServerless cloud architecture patterns
Serverless cloud architecture patterns
Jimmy Dahlqvist17 views

Derbycon - The Unintended Risks of Trusting Active Directory

  • 1. The Unintended Risks of Trusting Active Directory
  • 2. @harmj0y Red teamer and offensive engineer at SpecterOps Adaptive Threat Division alumni Avid blogger (http://harmj0y.net) Co-founder of GhostPack, Empire, BloodHound, Veil-Framework 2
  • 3. @tifkin_ Red teamer, hunter, and researcher at SpecterOps Adaptive Threat Division alumni Forever going after shiny things Contributor to various projects/blog posts 3
  • 4. @enigma0x3 Red teamer and security researcher at SpecterOps Adaptive Threat Division alumni Avid blogger (https://enigma0x3.net/), COM lover, CVE holder 4
  • 5. What is “Admin Access” ? Hint: it’s more complicated than just “local administrators”! 5
  • 6. The “True” Nature of Administrative Access ▪ Controversial statement: membership in a system’s local administrators group isn’t what ultimately matters! ▪ What actually matters is what local/domain groups have access to specific remote resources (RPC, remote reg, WMI, SQL, etc.) based on the host service’s security descriptors 6
  • 8. Wait, Security Descriptors? ACLs? What are Those and Why Should I Care? 8
  • 9. Security descriptors are the Windows mechanism to control authenticated access to resources, or “securable objects” 9 PS: lots of caveats here :)
  • 10. What Is a “Securable Object”? Why, a Windows object that can have a security descriptor, of course! 10
  • 12. From Owners to DACLs to ACEs ▪ An object’s Owner completely controls an object ▪ An object’s Discretionary Access Control List (DACL) is collection of Access Control Entries (ACEs) ▫ ACEs – Allow/Deny rules of who can do what to an object 12
  • 13. 13
  • 14. Authorization Checks ▪ Individual services perform authorization checks when objects are accessed ▪ Services compare the requestor’s user/group SIDs to the DACL and grant/deny access ▪ Local “Administrators” is a group many services grant access to by default (but it could be denied) 14
  • 15. OK, That’s “Cool” but Why Should I Care, Really? 15
  • 16. Why Care? ▪ It’s often difficult to determine whether a specific security descriptor misconfiguration was set maliciously or configured by accident ▫ Existing misconfigurations: privesc/lateral movement opportunities ▫ Malicious misconfiguration changes: persistence! ▪ These changes often have a minimal forensic footprint ▪ Many teams are not aware of these misconfigurations, much less how to identify, abuse, or remediate them 16
  • 17. Host-based Security Descriptors More than just the service control manager yo’
  • 18. Discovering Host Securable Objects ▪ Windows documentation lists about 20-30 securable objects* ▪ We’ve identified 70+! (There are *many* more) ▪ Microsoft Protocol Specifications ▫ Very useful for RPC servers ;) ▪ Find-RegistrySecurityDescriptors.ps1 ▪ @tiraniddo’s NtObjectManager project 18*https://msdn.microsoft.com/en-us/library/windows/desktop/aa379557(v=vs.85).aspx
  • 19. 19
  • 20. Persistent vs Runtime Security Descriptors ▪ Where do objects get their security descriptor? ▫ Persistent - Security descriptor loaded from registry, file, etc. ▫ Runtime - Security descriptor is in memory ▪ Our approach for enumeration: ▫ Locally as an unprivileged user ▫ Locally as a privileged user ▫ Remotely as an unprivileged user ▫ Remotely as a privileged user 20
  • 21. Example: Remote Registry ▪ Imagine this scenario: remotely dumping an endpoint’s machine account hash as an “unprivileged” user (i.e. not in local admins)! ▪ Backdoor Process ▫ Remotely backdoor the winreg key with an attacker- controlled user/group (this key == remote registry access) ▫ Add malicious ACEs to a few specific registry hives/keys so we can read LSA secrets remotely 21
  • 22. Example: Remote Registry ▪ (Remote) Backdoor Execution ▫ As the backdoor (domain or local) user, connect to the remote registry service on the backdoored system ▫ Open up specific reg keys linked to LSA and extract their classes ▫ Combine these class values and compute the BootKey ▫ Use the BootKey to decrypt the LSA key ▫ Use the LSA key to decrypt the machine account hash! ▫ EVERYONE GETS A SILVER TICKET!! 22
  • 23. Active Directory Security Descriptors Everything needs an access control model, even AD
  • 24. Active Directory ACL Advantages 24 ▪ A big advantage: by default the DACLs for nearly every AD object can be enumerated by any authenticated user in the domain through LDAP! ▪ Other advantages of AD ACLs: ▫ Changes also have a minimal forensic footprint ▫ Changes often survive OS and domain functional level upgrades, i.e. “misconfiguration debt” ▫ Anti-audit measures can be taken!
  • 26. Generic Rights We Care About 26 GenericAll Allows ALL generic rights to the specified object GenericWrite Allows for the modification of (almost) all properties on a specified object WriteDacl Grants the ability to modify the DACL in the object security descriptor WriteOwner Grants the ability to take ownership of the object
  • 27. Object-specific Rights We Care About (abbreviated) 27 Users User-Force-Change-Password or write to the servicePrincipalName Groups Write to the member property Computers None outside of LAPS :( GPOs Modification of GPC-File-Sys-Path Domains WriteDacl to add DCSync rights
  • 28. Example: Abusing Exchange ▪ Exchange Server introduces several schema changes, new nested security groups, and MANY control relationships to Active Directory, making it a perfect spot to blend in amongst the noise! ▪ Pre Exchange Server 2007 SP1, this included the WriteDACL privilege against the domain object itself with Exchange Trusted Subsystem as the principal 28
  • 29. Active Directory + Host ACL Abuse Plugging the Gaps in Attack Chains
  • 30. ▪ Prior to joining active directory, the host is in ultimate control of who can access its resources ▪ After a machine is joined to AD, a few things happen: ▫ The machine is no longer solely in charge of authentication ▫ A portion of key material for the host is stored in another location (machine account hash in ntds.dit) ▫ Default domain group SIDs are added to local groups ▫ Management is no longer solely left to the host (i.e. GPOs :) “Risks” Of Joining Active Directory 30
  • 31. Active Directory: Before and After 31 Workgroup Security Principals Local users/groups Access/Permission Management Host-based Security Descriptors Authentication NTLM (SAM) Resource Administration Manual Active Directory + Domain users/groups + Default domain groups added to local groups + Kerberos/NTLM (NTDS) + GPOs
  • 32. Active Directory: Before and After 32 DCOM Service Administrators admin DOMAINDomain Admins Distributed COM Users DOMAINsrvcacct DOMAINjohnDOMAINsrvadms DOMAINlee
  • 33. Security Implications ▪ Host-based security descriptors are the missing link when thinking about domain attack graphs! ▪ There ARE existing “misconfigurations” in the security descriptors in some host-based services! ▫ More to come on this in a bit ;) ▪ Host-based security descriptor modifications can be chained with AD misconfigurations/modifications ▪ “Fills the gap” left by the lack of an AD ACL computer primitive 33
  • 34. tl;dr Security Implications of Joining Active Directory ▪ When you join a system to Active Directory, you’re introducing additional nodes into the access graph that may affect the security of other systems ▪ You’re also implicitly trusting the security of a large number of other nodes in the graph as well ▫ You’re almost certainly exposing your system’s services to more access than you realize! 34
  • 35. Case Study #1 Picking on Exchange Again :)
  • 36. Case Study: Exchanging Rights ▪ We saw before that the Exchange Trusted Subsystem group (which contains Exchange servers) often has a huge number of rights over the domain ▪ So let’s integrate the remote registry host-based backdoor on an Exchange box! ▫ No changes to the DC or any AD data ▫ Takes advantage of existing misconfigurations! 36
  • 37. 37
  • 38. Case Study #2 Abusing Existing Misconfigurations
  • 39. Ingredient #1: Unconstrained Delegation ▪ If a server is configured for unconstrained delegation, service ticket requests will include the requestor’s TGT stuffed into the service ticket ▪ So if you can get a principal to auth to an unconstrained server you control, you can extract their TGTs out of memory! ▪ More information: https://adsecurity.org/?p=1667 39
  • 40. Ingredient #2: Effectively Extracting TGTs ▪ Rubeus is a new C# Kerberos abuse toolkit that includes various ticket extraction capabilities ▪ The monitor action will monitor 4624 logon events from the event log and extract any new usable TGT .kirbis from LSASS using LSA APIs ▫ No read handle to LSASS needed! 40https://github.com/GhostPack/Rubeus
  • 41. Ingredient #3: The Printer Bug ▪ Old but enabled-by-default-on-Windows Print System Remote Protocol (MS-RPRN) ▪ RpcRemoteFindFirstPrinterChangeNotification(Ex) ▫ Purpose: “REMOTESERVER, send me a notification when ____” (e.g. when there’s a new print job) ▪ Implication: *Any domain user* can coerce REMOTESERVER$ to authenticate to any machine ▫ Won’t fix by Microsoft - “ by design” ☺ 41
  • 42. Ingredient #3: The Printer Bug 42 Domain User/Attacker: Please authenticate to OTHERHOST SERVER OTHERHOST Abuse Scenarios ▪ Machine account TGT theft via Unconstrained Delegation ▪ NTLM attacks!!!! ▪ NTLM-relay to ______ protocol ▪ Is SERVER$ local admin anywhere? (Relay and login) ▪ LDAP relay anyone…. ☺ ▪ NTLMv1 downgrade attacks - XP/2003 anyone?
  • 43. The Dangerous Recipe 1. Compromise a server configured with unconstrained delegation 2. Beginning monitoring for delegated TGTs ▫ Start Rubeus’ monitor action with /interval:5 3. Coerce a domain controller to authenticate to the unconstrained server using SpoolSample 4. Load the extracted ticket, DCSync, profit! 43
  • 44. 44
  • 45. 45 Summary ▪ Access is more than just “local administrators” ! ▪ Host based security descriptors (accidentally misconfigured, configured by default, or maliciously backdoored) can have far-reaching implications for the security of other systems in the domain! ▪ Defense should focus on restricting access to ALL securable objects (host, AD, Exchange, etc.)
  • 46. 46 Questions? You can find us at @SpecterOps: ▪ @harmj0y , @tifkin_ , @enigma0x3 ▪ [will,lee,matt]@specterops.io Credit to @elad_shamir for subsequent discovery of the printer bug!
  • 47. Appendix: Printer Bug Details ▪ Print System Remote Protocol (MS-RPRN) ▫ All comms are SMB-RPC (TCP 445) ▫ Named Pipe: pipespoolss ▫ RPC UUID: 12345678-1234-ABCD-EF00-0123456789AB ▫ “Discovered” by reading the protocol spec (likely more RPC servers that do a similar thing) 47
  • 48. Appendix: Printer Bug Details ▪ Opnum 62 or 65 ▫ RpcRemoteFindFirstPrinterChangeNotification ▫ RpcRemoteFindFirstPrinterChangeNotificationEx ▪ The RPC server is accessible by all domain users on Windows >= 8 if the Spooler service is started (Server & Workstations have it enabled by default) ▫ On Windows < 8 , seems possible if the host has shared a printer 48
  • 49. Appendix: Coerced Machine Account Authentication Attack Scenarios ▪ Printer bug isn’t the only way to do this (we’ve already confirmed from our own research/other that there’s other vectors) ▪ If NTLMv1 enabled? Do an NTLMv1 downgrade and get the machine’s NTLM hash ▪ NTLM relay ▫ Is a machine account a member of the local Administrators group on any machine? (Often seen on SCCM and Exchange servers) ▫ NTLM relay to LDAP and grant yourself DCSync rights if LDAP signing not enforced (see @_dirkjan’s contribution to ntlmrelayx) ▫ Problematic with SMB -> LDAP due to SMB clients setting the signing bit (thanks @_dirkjan!) 49
  • 50. Hi Lee, The team has finished its investigation and determined the issue is by-design. From the NTLM side of things, this is a relay attack, and there are plenty of mitigations that customers can use to mitigate this particular attack: 1. Restrict NTLM usage 2. Configure/enable Extended Protection for Authentication for all services that support it. 3. Enable SMB Signing or SMB Encryption 4. Do not grant machine accounts administrative privileges to other machine accounts 50
  • 51. Additional Guidance ▪ Impersonating domain machine accounts is by design? ¯_(ツ)_/¯ ▫ We don’t think it was, but nonetheless, it’s possible ▪ Restricting access to hosts/networks goes a LONG way ▫ Windows does not require inbound network access in order to work in Active Directory! ▫ FIREWALLS!! Host-based and network ▫ IPSec ▪ Prevent relaying to LDAP: Set LdapEnforceChannelBinding to 1 51