RootedCON, profile picture
Uploaded byRootedCON
PDF, PPTX4,894 views

Carlos García - Pentesting Active Directory Forests [rooted2019]

The document discusses penetration testing of Active Directory forests and trusts. It begins with an introduction to forests, domains, and trust types. It then covers authentication protocols like NTLM and Kerberos across trusts. Next, it discusses techniques for enumerating trusts and mapping the trust relationships. The document outlines common attacks when domain admin privileges are available, such as using Golden Tickets and SID history exploitation. For situations without domain admin, it recommends reconnaissance of trusts and objects to map a path to privileged accounts.

Embed presentation

Download as PDF, PPTX
ciyinet PENTESTING ACTIVE DIRECTORY FORESTS CARLOS GARCÍA GARCÍA ciyinet
ciyinet CARLOS GARCÍA GARCÍA Computer Science Eng. OSCP Penetration Testing Hack&Beers, Qurtuba… Organizer Co-author book Hacking Windows: Ataques a Sistemas y redes Microsoft PS C:> WHOAMI 2
ciyinet WHAT ARE WE GOING TO TALK ABOUT? - Introduction to Active Directory Forests and Trusts - Why Pentesting Trusts? - Authentication Protocols across Trusts - Trusts enumeration - Common Attacks & Techniques - Reconnaissance across Trusts - Conclusions 3
ciyinet FORESTS - Domains are structured into trees and forests - A tree is a collection of related domains - A forest is a collection of trees that trust each others - Only one “Enterprise Admins” group per forest - Exists in root domain only - Non-existing in child domains - Added as local admin in child domain’s DCs 4
ciyinet TRUSTS - Allow authentication traffic to flow between two domains - Establish the ability for users in one domain to authenticate to resources in another domain 5
ciyinet TRUST DIRECTION - One-way - Domain B trusts A - Users in Domain A can access resources in Domain B. Users in domain B cannot access domain A - Two-way - Domain A trusts B, domain B trusts A - Authentication requests can be passed between the two domains in both directions 6
ciyinet TRUST TRANSITIVITY Determines if a trust can be extended outside of the two domains - Transitive - Extends trust relationship with other domains - Let a trusted domain pass through to a third domain - Non-transitive - Denies trust relationship with other domains 7
ciyinet TYPE OF TRUSTS Type Direction Transitivity Description Parent-Child 2-way Transitive Automatically established when a new domain is created in a tree Tree-Root 2-way Transitive Automatically established when a new tree is added to a forest. Between the new tree root and the forest root domain External 1-way or 2-way Non-transitive Manually created between a domain in a forest and another domain in a different forest that does not have a forest trust established Forest 1-way or 2-way Transitive Manually created between one forest root domain and another forest root domain Shortcut 1-way or 2-way Transitive Manually created between domains in the same forest that is used to shorten the trust path in a large and complex domain tree or forest and improve authentication times Realm 1-way or 2-way Transitive or Non-transitive Manually created between an AD domain and a non-Windows Kerberos V5 realm References: https://blogs.msmvps.com/acefekay/2016/11/02/active-directory-trusts 8
ciyinet TRUSTS - All trusts within the same forest are two-way and transitive - This is why all domains within a forest trust each other - Users from any domain can access resources in any other domain within the forest as long as: - They have the proper permissions assigned at the resource - They have network access 9
ciyinet entityA.com spain.entityA.com uk.entityA.com group1.net sales.group1.net Parent-Child trust Parent-Child trust Tree-Root trust Parent-Child trust cordoba.spain.entityA.com Parent-Child trust Tree 2: entityB.net Tree 1: entityA.com Forest: entityA 10
ciyinet DIRECTION OF TRUST VS ACCESS Domain A Trusted domain (inbound) Domain B Trustring domain (outbound) Direction of access Direction of trust 11
ciyinet Why Pentesting Trusts? PENTESTING ACTIVE DIRECTORY FORESTS
ciyinet WHY PENTESTING TRUSTS? - Environments with trusts that were created many years ago without security in mind - Sometimes domain trusts introduce unintended access paths - Some domains (i.e. testing, development…) are not well maintained, controlled or monitored 13
ciyinet WHY PENTESTING TRUSTS? Or simply, what if your target is in a different domain? Reconnaissance Weaponisation and Exploitation Privilege Escalation & Lateral Movement Action on Targets Installation and Command & Control ▪ Email harvesting ▪ Social Networking ▪ IP Discovery ▪ Port Scanning ▪ Identify vulnerabilities ▪ Build and deliver malware via phishing, web, USB drive, network… ▪ Exploit a vulnerability to compromise the victim’s system ▪ Install malware ▪ Stablish persistence inside the environment ▪ Command channel for remote access ▪ Obtain more credentials ▪ Access other systems ▪ Escalate privileges ▪ Identify critical assets ▪ Data exfiltration ▪ Encryption of critical assets ▪ Service disruption ▪ Money $$$ References: Kroll Proactive Security Team 14
ciyinet Authentication Protocols PENTESTING ACTIVE DIRECTORY FORESTS
ciyinet CREDENTIALS FLOW IN WINDOWS 16
ciyinet NTLM ACROSS TRUSTS 1. User requests access and sends DOMAIN-AUSERNAME Client in DOMAIN-A 2. Server sends challenge message 3. Client sends response message 4. Server sends DOMAIN-AUSERNAME challenge and response to DC in DOMAIN-B Server in DOMAIN-B DC in DOMAIN-B DC in DOMAIN-A References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc773178(v=ws.10) https://blogs.technet.microsoft.com/askpfeplat/2013/05/05/how-domain-controllers-are-located-across-trusts/ https://blogs.technet.microsoft.com/isrpfeplat/2010/11/05/optimizing-ntlm-authentication-flow-in-multi-domain-environments/ 8. Server sends authentication result to the client 7. Response to authenticate user 17
ciyinet KERBEROS ACROSS TRUSTS When a user requests access to a resource in a different domain: - User’s DC will not be able to issue a TGS of another domain as TGS can only be built using the target service’s password and DC only contain password data from security principals in their own domain - To solve this, the there is a trusts password between two domains in the same AD forest used as a bridge enable Kerberos authentication across trust 18
ciyinet KERBEROS ACROSS TRUSTS Client in DOMAIN-A 1. Request TGT (AS-REQ) 2. Receive TGT (AS-REP) Server in DOMAIN-B DC in DOMAIN-A DC in DOMAIN-B References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc773178(v=ws.10) https://adsecurity.org/?p=1588 3. Present TGT, request TGS (TGS-REQ) 4. Receive inter-realm TGT (TGS-REP) Client encrypts a timestamp with their secret (hash/key) Client receives a TGT signed with the DOMAIN-A krbtgt account that proves they are who they say they are The TGT is then used to request TGS for specific resources/services on the DOMAIN-B DC sends a TGT for DOMAIN-B signed and encrypted using the inter-realm key DC sends a TGS ticket encrypted using the hash/key of the account that is associated with that service (SPN) The TGT is then used to request service tickets (TGS) for specific services on the domain. TGT I-R TGT TGS 19
ciyinet Trusts Enumeration PENTESTING ACTIVE DIRECTORY FORESTS
ciyinet TRUSTS ENUMERATION So we land in the organization; the exploitation path will depend on: - Domain you land on and its trusts - Privileges you manage to get in it - User’s privileges in foreign domains ? ? ? 21
ciyinet test.dev.ciyilab.local TRUSTS ENUMERATION testcordoba srvproject 23
ciyinet TRUSTS ENUMERATION - NLTEST - Different information depending on where it’s executed from quarantined_domain = Filter_sids nltest /domain_trusts nltest /dclist:DOMAIN nltest /server:DC /trusted_domains 24
ciyinet TRUSTS ENUMERATION - POWERVIEW - To enumerate trusts on a foreign domain, you need to able to bind to a DC (usually PDC) on the foreign domain* - Get-DomainTrust –SearchBase “GC://$($ENV:USERDNSDOMAIN)” - Return all forest trusts for the current forest or a specified forest Get-DomainTrust –Domain FOREIGN DOMAIN FQDN Get-ForestTrust –Domain FOREIGN DOMAIN FQDN 25
ciyinet TRUST MAPPING PowerView BloodHound Get-DomainTrustMapping Invoke-BloodHound –CollectionMethod Trusts –SearchForest Invoke-BloodHound –CollectionMethod Trusts –Domain FOREIGN DOMAIN FQDN 27
ciyinet Forest TRICIAForest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local TRUST MAPPING Parent-Child trust Parent-Child trust assuan.local Tree-Root trust tricia.local Forest trust Forest CANETE canete.local External trust 28
ciyinet Exploitation Path – Common Attacks & Techniques PENTESTING ACTIVE DIRECTORY FORESTS
ciyinet EXPLOITATION PATH Source (attacker’s location) Target domain Technique to use Trust relationship Root Child • Golden Ticket + Enterprise Admins group Inter-realm (2-way) Child Child • SID History exploitation Inter-realm Parent-Child (2-way) Child Root • SID History exploitation Inter-realm Tree-Root (2-way) Forest A Forest B • Printer bug + Unconstrained Delegation ? Intra-realm Forest or External (2-way) - Having Domain-Admin-level on the current domain: 30 - Not having Domain-Admin-level on the current domain: Reconnaissance + Exploitation (and always depending on type of trusts, direction and transitivity)
ciyinet Forest CIYILAB Forest TRICIA ciyilab.local dev.ciyilab.local test.dev.ciyilab.local DA-LEVEL TECHNIQUES – ROOT TO CHILD Parent-Child trust Parent-Child trust assuan.local Tree-Root trust tricia.local Forest trust Forest CANETE canete.local External trust Golden ticket + EA group 31
ciyinet ciyilab.local GOLDEN TICKET + ENTERPRISE ADMINS ciyilabciyi dc01 32 mimikatz.exe "kerberos::golden /domain:ROOT_DOMAIN_FQDN /sid:ROOT_DOMAIN_SID /krbtgt:ROOT_DOMAIN_KRBTGT_NT_HASH /user:USERNAME /groups:500,501,513,512,520,518,519 /ptt" Included by default. 519: RID of “Enterprise Admins” group
ciyinet Forest TRICIAForest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local DA-LEVEL TECHNIQUES – CHILD TO ROOT OR CHILD Parent-Child trust Parent-Child trust assuan.local Tree-Root trust tricia.local Forest trust Forest CANETE canete.local External trust SID history exploitation 34
ciyinet SID HISTORY - Used to migrate users from one domain to another - When a user is migrated, his old SID and all groups’ SIDs he’s a member of can be added to the attribute sidHistory - When the user tries to access a resource, his SID and the SIDs included in the sidHistory attribute are checked to grant/deny access - sidHistory is normally respected by domains within the forest. For external/forest trusts, they are filtered out by the “SID filtering” protection References: https://www.itprotoday.com/windows-78/exploiting-sidhistory-ad-attribute https://www.harmj0y.net/blog/redteaming/the-trustpocalypse/ https://gallery.technet.microsoft.com/migrate-ad-users-to-new-2e480804/ http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ 35
ciyinet test.dev.ciyilab.local SID HISTORY HOPPING/EXPLOITATION testAdministrator srvproject 36 mimikatz.exe "kerberos::golden /domain:CHILD_DOMAIN_FQDN /sid:CHILD_DOMAIN_SID /krbtgt:CHILD_DOMAIN_KRBTGT_NT_HASH /user:USERNAME /sids:ENTERPRISE_ADMINS_GROUP_SID /ptt" Get it with PowerView: ConvertTo-SID -ObjectName "Enterprise Admins" -Domain ROOT_DOMAIN_FQDN
ciyinet No Domain-Admin… No fun? PENTESTING ACTIVE DIRECTORY FORESTS
ciyinet EXPLOITATION PATH - Having Domain-Admin-level in the domain you are: - Not having Domain-Admin-level on the current domain: Reconnaissance + Exploitation (and always depending on type of trusts, direction and transitivy) 39 Source (attacker’s location) Target domain Technique to use Trust relationship Root Child • Golden Ticket + Enterprise Admins group Inter-realm (2-way) Child Child • SID History exploitation Inter-realm Parent-Child (2-way) Child Root • SID History exploitation Inter-realm Tree-Root (2-way) Forest A Forest B • Printer bug + Unconstrained Delegation ? Intra-realm Forest or External trust (2-way)
ciyinet RECONNAISSANCE 1. Enumerate trusts the current domain has and also trusts the other domains have 2. Enumerate objects: a. Enumerate security principals (i.e. users, groups, computers) in the current domain that have access to resources in another domain b. Enumerate groups that have users from another domain 3. Map exploitation path: what accounts need to be compromised to move from the current position to the target 40 References: http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/
ciyinet 1. TRUSTS ENUMERATION Forest CANETE canete.local 41
ciyinet Forest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local 1. TRUSTS ENUMERATION Parent-Child trust Parent-Child trust Forest CANETE canete.local External trust 43
ciyinet 2. OBJECT ENUMERATION Security principals (users/groups) can be configured to have access to resources in another domain as: - Members of a local group in foreign machines - Look for foreign local group membership - Members of a domain group in a foreign domain - Look for foreign domain group membership - Principals in ACEs in a DACL - Look for foreign security principals in ACE in a foreign domain 44
ciyinet TYPE OF GROUPS Group Visibility (available to) Can have members from Same domain Other domains in same forest Domains outside the forest (forest or external trust) Functional memberships Local Local • Users • Computers • Domain local groups • Global groups • Universal groups • Users • Computers • Global groups • Universal groups • Users • Computers • Global groups • Users in the same forest • Users in other forests (foreign security principals) AD Domain local Domain (Cannot be used outside the domain they’ve been created in) • Users • Computers • Other Domain local groups • Global groups • Universal groups • Users • Computers • Global groups • Universal groups • Users • Computers • Global groups • Users in the same forest • Users in other forests (foreign security principals) AD Global Forest(s) • Users • Computers • Other Global groups None None Cannot have users of other domains AD Universal Forest(s) (Stored within the Global Catalog) • Users • Computers • Global groups • Other Universal groups • Users • Computers • Global groups • Other Universal groups None Users in the same forest References: https://www.youtube.com/watch?v=aPh8_RB8XEU 45
ciyinet FOREIGN LOCAL GROUP MEMBERSHIP - Remote SAM (SAMR) or GPO correlation - Depending on current configuration (i.e. Windows firewall), in some cases we might need local admin privs on target to enumerate its local groups PowerView: Get-NetLocalGroup –ComputerName HOSTNAME Get-NetLocalGroupMemeber –ComputerName HOSTNAME -GroupName GROUP References: http://www.harmj0y.net/blog/redteaming/local-group-enumeration/ 46
ciyinet Forest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local 1. TRUSTS ENUMERATION Parent-Child trust Parent-Child trust Forest CANETE canete.local External trust 47
ciyinet dev.ciyilab.local canetezoidberg madw1201.dev.ciyilab.local 49
ciyinet Forest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local Parent-Child trust Parent-Child trust Forest CANETE canete.local External trust 50
ciyinet dev.ciyilab.local devmadw1201$ madw1201.dev.ciyilab.local 52
ciyinet Forest TRICIAForest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local Parent-Child trust Parent-Child trust assuan.local Tree-Root trust tricia.local Forest trust Forest CANETE canete.local External trust 53
ciyinet FOREIGN USER MEMBERSHIP Enumerate users in groups outside of the user’s domain. This can be used within the same forest PowerView: *Only Universal groups membership will be reflected Get-DomainForeignUser –Domain FOREIGN DOMAIN FQDN 54
ciyinet FOREIGN GROUP MEMBERSHIP Enumerate groups in the target domain that contains users that are not from the target domain. This can be used against domain within the same forest or through a external/forest trust PowerView: Get-DomainForeignGroupMember –Domain FOREIGN DOMAIN FQDN 56
ciyinet FOREIGN ACL PRINCIPALS 1. Enumerate DACLs (and their ACE entries) of all objects in domains that trusts yours 2. Only analyze ACE entries with foreign security principals This can be used against domain within the same forest or through a external/forest trust PowerView to list ACE entries with security principals from our domain: Get-DomainObjectAcl –Domain FOREIGN DOMAIN FQDN –ResolveGUIDs | Where-Object {$_.SecurityIdentifier –like ‘CURRENT_DOMAIN_SID*’} 57
ciyinet 3. MAPPING EXPLOITATION PATH – OBJECT ENUMERATION WITH BLOODHOUND BloodHound can enumerate trusts and objects in foreign domains (local and domain groups membership, ACLs, etc.) Invoke-BloodHound –SearchForest Invoke-BloodHound –Domain FOREIGN DOMAIN FQDN 58
ciyinet Forest CANETE canete.local 59
ciyinet Forest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local Parent-Child trust Parent-Child trust Forest CANETE canete.local External trust 62
ciyinet Forest TRICIAForest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local Parent-Child trust Parent-Child trust assuan.local Tree-Root trust tricia.local Forest trust Forest CANETE canete.local External trust 64
ciyinet PENTESTING ACTIVE DIRECTORY Wrapping Up
ciyinet WRAPPING UP – “METHODOLOGY” 1. Enumerate trusts the current domain has and also trusts the other domains have 2. Is the target within the same forest? Yes: step 3 No: steps 4 and 5 3. Got DA-level privileges in the current domain? Yes: use DA-level techniques No: steps 4 and 5 4. Enumerate objects: a. Security principals (i.e. user, groups, computers) in the current domain that have access to resources in another domain b. Groups that have users from another domain c. Foreign security principals in ACE in foreign domains 5. Map exploitation path What accounts need to be compromised to move from the current position to the target 67
ciyinet Conclusions PENTESTING ACTIVE DIRECTORY FORESTS
ciyinet CONCLUSIONS - If other domain trusts our domain, we can query their AD information - Trusts can introduce unintended access paths - Domain trust boundaries are not security boundaries - Losing control of the KRBTGT account password hash of any domain equates to losing control of the entire forest - You must reset KRBTGT (twice) in every domain in the forest! 69
ciyinet BUSINESS RISK Compromise of just one Domain Admin account in the Active Directory forest exposes the entire organization to risk. The attacker would have unrestricted access to all resources managed by all domains, users, servers, workstations and data. Moreover, the attacker could instantly establish persistence in the Active Directory environment, which is difficult to notice and cannot be efficiently remediated with guarantees. “Once Domain Admin, always Domain Admin” “Once any Domain Admin, always Enterprise Admin” 70
ciyinet ACKNOWLEDGMENT & REFERENCES - My brother (Happy B-DAY!!!) - Francisco Tocino - Nikhil Mittal (@nikhil_mitt) - Will Schroeder (@harmj0y) - Andrew Robbins (@_wald0) - Benjamin Delpy (@gentilkiwi) - Sean Metcalf (@PyroTek3) 71
ciyinet 72
ciyinet 73
PENTESTING ACTIVE DIRECTORY FORESTS
ciyinet PENTESTING ACTIVE DIRECTORY FORESTS ciyinet carlos@ciyi.es CARLOS GARCÍA GARCÍA

More Related Content

PPTX
Abusing Microsoft Kerberos - Sorry you guys don't get it
byBenjamin Delpy
 
PDF
Derbycon - The Unintended Risks of Trusting Active Directory
byWill Schroeder
 
PDF
Attacker's Perspective of Active Directory
bySunny Neo
 
PDF
DerbyCon 2019 - Kerberoasting Revisited
byWill Schroeder
 
PDF
Carlos García - Pentesting Active Directory [rooted2018]
byRootedCON
 
PPTX
I hunt sys admins 2.0
byWill Schroeder
 
PPTX
(Ab)Using GPOs for Active Directory Pwnage
byPetros Koutroumpis
 
PDF
0wn-premises: Bypassing Microsoft Defender for Identity
byNikhil Mittal
 
Abusing Microsoft Kerberos - Sorry you guys don't get it
byBenjamin Delpy
 
Derbycon - The Unintended Risks of Trusting Active Directory
byWill Schroeder
 
Attacker's Perspective of Active Directory
bySunny Neo
 
DerbyCon 2019 - Kerberoasting Revisited
byWill Schroeder
 
Carlos García - Pentesting Active Directory [rooted2018]
byRootedCON
 
I hunt sys admins 2.0
byWill Schroeder
 
(Ab)Using GPOs for Active Directory Pwnage
byPetros Koutroumpis
 
0wn-premises: Bypassing Microsoft Defender for Identity
byNikhil Mittal
 

What's hot

PPTX
Troopers 19 - I am AD FS and So Can You
byDouglas Bienstock
 
PDF
ReCertifying Active Directory
byWill Schroeder
 
PPTX
Windows Privilege Escalation
byRiyaz Walikar
 
PDF
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...
byDirkjanMollema
 
PDF
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
PPTX
Hashicorp Vault ppt
byShrey Agarwal
 
PDF
Fantastic Red Team Attacks and How to Find Them
byRoss Wolf
 
PPT
OWASP Top Ten
byChristian Heinrich
 
PDF
aclpwn - Active Directory ACL exploitation with BloodHound
byDirkjanMollema
 
PDF
A Threat Hunter Himself
byTeymur Kheirkhabarov
 
PDF
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
PPTX
OK Google, How Do I Red Team GSuite?
byBeau Bullock
 
PDF
Thick Client Penetration Testing.pdf
bySouvikRoy114738
 
PDF
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
PDF
Introducing Vault
byRamit Surana
 
PDF
A Threat Hunter Himself
bySergey Soldatov
 
PDF
A Year in the Empire
byWill Schroeder
 
PDF
DNS hijacking using cloud providers – No verification needed
byFrans Rosén
 
PDF
How fun of privilege escalation Red Pill2017
byAmmarit Thongthua ,CISSP CISM GXPN CSSLP CCNP
 
Troopers 19 - I am AD FS and So Can You
byDouglas Bienstock
 
ReCertifying Active Directory
byWill Schroeder
 
Windows Privilege Escalation
byRiyaz Walikar
 
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...
byDirkjanMollema
 
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
Hashicorp Vault ppt
byShrey Agarwal
 
Fantastic Red Team Attacks and How to Find Them
byRoss Wolf
 
OWASP Top Ten
byChristian Heinrich
 
aclpwn - Active Directory ACL exploitation with BloodHound
byDirkjanMollema
 
A Threat Hunter Himself
byTeymur Kheirkhabarov
 
Hunting for Credentials Dumping in Windows Environment
byTeymur Kheirkhabarov
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
byMITRE ATT&CK
 
OK Google, How Do I Red Team GSuite?
byBeau Bullock
 
Thick Client Penetration Testing.pdf
bySouvikRoy114738
 
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
Introducing Vault
byRamit Surana
 
A Threat Hunter Himself
bySergey Soldatov
 
A Year in the Empire
byWill Schroeder
 
DNS hijacking using cloud providers – No verification needed
byFrans Rosén
 
How fun of privilege escalation Red Pill2017
byAmmarit Thongthua ,CISSP CISM GXPN CSSLP CCNP
 

Similar to Carlos García - Pentesting Active Directory Forests [rooted2019]

PDF
Trusts You Might Have Missed - 44con
byWill Schroeder
 
PPTX
Active directory domain and trust
byChinmoy Jena
 
PDF
Active Directory Trusts
byn|u - The Open Security Community
 
PPTX
Active Directory Trusts
byYatinWadhwa2
 
PPT
2.2 determining trust relationships
byMuuluu
 
PPTX
Trusts You Might Have Missed
byWill Schroeder
 
PPTX
Building active directory lab for red teaming
byn|u - The Open Security Community
 
PDF
Not a Security Boundary
byWill Schroeder
 
PPTX
Active Directory Domains and Trust, Sites and Services.pptx
bynavneetyohaya
 
PPTX
Hunt for Domain Controller : Active Directory Pentesting Session
byhacknpentest
 
PDF
70 412 pdf training guides 2018
bybirhanu atnafu
 
DOC
Active directory domain and trust
byproser tech
 
PPTX
PSConfEU - Offensive Active Directory (With PowerShell!)
byWill Schroeder
 
PPTX
Derbycon - Passing the Torch
byWill Schroeder
 
PDF
Web sphere user group march 2012 - desktop single sign-on in an active dire...
byDave Hay
 
PDF
Dave hay desktop single sign-on in an active directory world
byDave Hay
 
PDF
Dave hay desktop single sign-on in an active directory world
byDave Hay
 
PDF
Hacktive Directory Forensics - HackCon18, Oslo
byYossi Sassi
 
PPTX
Breadcrumbs to Loaves: BSides Austin '17
byBrandon Arvanaghi
 
PDF
Ad domain n trust
bymuneebalisyed
 
Trusts You Might Have Missed - 44con
byWill Schroeder
 
Active directory domain and trust
byChinmoy Jena
 
Active Directory Trusts
byn|u - The Open Security Community
 
Active Directory Trusts
byYatinWadhwa2
 
2.2 determining trust relationships
byMuuluu
 
Trusts You Might Have Missed
byWill Schroeder
 
Building active directory lab for red teaming
byn|u - The Open Security Community
 
Not a Security Boundary
byWill Schroeder
 
Active Directory Domains and Trust, Sites and Services.pptx
bynavneetyohaya
 
Hunt for Domain Controller : Active Directory Pentesting Session
byhacknpentest
 
70 412 pdf training guides 2018
bybirhanu atnafu
 
Active directory domain and trust
byproser tech
 
PSConfEU - Offensive Active Directory (With PowerShell!)
byWill Schroeder
 
Derbycon - Passing the Torch
byWill Schroeder
 
Web sphere user group march 2012 - desktop single sign-on in an active dire...
byDave Hay
 
Dave hay desktop single sign-on in an active directory world
byDave Hay
 
Dave hay desktop single sign-on in an active directory world
byDave Hay
 
Hacktive Directory Forensics - HackCon18, Oslo
byYossi Sassi
 
Breadcrumbs to Loaves: BSides Austin '17
byBrandon Arvanaghi
 
Ad domain n trust
bymuneebalisyed
 

More from RootedCON

PDF
Rooted2020 A clockwork pentester - Jose Carlos Moral & Alvaro Villaverde
byRootedCON
 
PDF
rooted2020 Sandbox fingerprinting -_evadiendo_entornos_de_analisis_-_victor_c...
byRootedCON
 
PDF
Rooted2020 hunting malware-using_process_behavior-roberto_amado
byRootedCON
 
PPSX
Rooted2020 compliance as-code_-_guillermo_obispo_-_jose_mariaperez_-_
byRootedCON
 
PDF
Rooted2020 the day i_ruled_the_world_deceiving_software_developers_through_op...
byRootedCON
 
PPTX
Rooted2020 si la-empresa_ha_ocultado_el_ciberataque,_como_se_ha_enterado_el_r...
byRootedCON
 
PPTX
Rooted2020 wordpress-another_terror_story_-_manuel_garcia_-_jacinto_sergio_ca...
byRootedCON
 
PPTX
Rooted2020 Atacando comunicaciones-de_voz_cifradas_-_jose_luis_verdeguer
byRootedCON
 
PDF
rooted2020-Rootkit necurs no_es_un_bug,_es_una_feature_-_roberto_santos_-_jav...
byRootedCON
 
PDF
Rooted2020 stefano maccaglia--_the_enemy_of_my_enemy
byRootedCON
 
PPTX
Rooted2020 taller de-reversing_de_binarios_escritos_en_golang_-_mariano_palom...
byRootedCON
 
PPTX
Rooted2020 virtual pwned-network_-_manel_molina
byRootedCON
 
PDF
Rooted2020 van a-mear_sangre_como_hacer_que_los_malos_lo_paguen_muy_caro_-_an...
byRootedCON
 
PDF
Rooted2020 todo a-siem_-_marta_lopez
byRootedCON
 
PPTX
Rooted2020 roapt evil-mass_storage_-_tu-ya_aqui_-_david_reguera_-_abel_valero
byRootedCON
 
PDF
Rooted2020 live coding--_jesus_jara
byRootedCON
 
PDF
Rooted2020 legalidad de-la_prueba_tecnologica_indiciaria_cuando_tu_papi_es_un...
byRootedCON
 
PDF
Rooted2020 hackeando el-mundo_exterior_a_traves_de_bluetooth_low-energy_ble_-...
byRootedCON
 
PDF
Rooted2020 evading deep-learning_malware_detectors_-_javier_yuste
byRootedCON
 
PDF
Rooted2020 encontrando 0days-en_2020_-_antonio_morales
byRootedCON
 
Rooted2020 A clockwork pentester - Jose Carlos Moral & Alvaro Villaverde
byRootedCON
 
rooted2020 Sandbox fingerprinting -_evadiendo_entornos_de_analisis_-_victor_c...
byRootedCON
 
Rooted2020 hunting malware-using_process_behavior-roberto_amado
byRootedCON
 
Rooted2020 compliance as-code_-_guillermo_obispo_-_jose_mariaperez_-_
byRootedCON
 
Rooted2020 the day i_ruled_the_world_deceiving_software_developers_through_op...
byRootedCON
 
Rooted2020 si la-empresa_ha_ocultado_el_ciberataque,_como_se_ha_enterado_el_r...
byRootedCON
 
Rooted2020 wordpress-another_terror_story_-_manuel_garcia_-_jacinto_sergio_ca...
byRootedCON
 
Rooted2020 Atacando comunicaciones-de_voz_cifradas_-_jose_luis_verdeguer
byRootedCON
 
rooted2020-Rootkit necurs no_es_un_bug,_es_una_feature_-_roberto_santos_-_jav...
byRootedCON
 
Rooted2020 stefano maccaglia--_the_enemy_of_my_enemy
byRootedCON
 
Rooted2020 taller de-reversing_de_binarios_escritos_en_golang_-_mariano_palom...
byRootedCON
 
Rooted2020 virtual pwned-network_-_manel_molina
byRootedCON
 
Rooted2020 van a-mear_sangre_como_hacer_que_los_malos_lo_paguen_muy_caro_-_an...
byRootedCON
 
Rooted2020 todo a-siem_-_marta_lopez
byRootedCON
 
Rooted2020 roapt evil-mass_storage_-_tu-ya_aqui_-_david_reguera_-_abel_valero
byRootedCON
 
Rooted2020 live coding--_jesus_jara
byRootedCON
 
Rooted2020 legalidad de-la_prueba_tecnologica_indiciaria_cuando_tu_papi_es_un...
byRootedCON
 
Rooted2020 hackeando el-mundo_exterior_a_traves_de_bluetooth_low-energy_ble_-...
byRootedCON
 
Rooted2020 evading deep-learning_malware_detectors_-_javier_yuste
byRootedCON
 
Rooted2020 encontrando 0days-en_2020_-_antonio_morales
byRootedCON
 

Recently uploaded

PDF
ICT500 - CRITICAL AND CREATIVE THINKING FOR INFORMATION TECHNOLOGY SOLUTIONS:...
by2024432452
 
PPTX
TechSprint WinterHack — Top 10 Teams Pitching Session we are excited for pit...
bybajpaitusharoffon678
 
PDF
AI and Zero Trust: What it takes to do it right
byMark Simos
 
PDF
UiPath Automation Developer Associate Training Series 2026 - Session 2
byDianaGray10
 
PDF
Writing GPU-Ready AI Models in Pure Java with Babylon
byAna-Maria Mihalceanu
 
PDF
Analyze and Preserve Logs - RHCSA (RH134).pdf
byLinuxCert Guru
 
PDF
UiPath Automation Developer Associate Training Series 2026 - Session 1
byDianaGray10
 
PDF
Track Phone Location via Number (2026)_ What Actually Works, What’s a Scam, a...
byEmily Woods
 
PPTX
Beyond the Algorithm: Designing Human-Centric Public Service with AI
byAlan Dix
 
PPTX
Introduction to Artificial Intelligence (AI).pptx
byammar414783
 
PDF
Dev Dives: Build and deploy agentic automations - the unified way
byUiPathCommunity
 
PDF
Computer-Based Training (CBT) The Backbone of Modern Technical & Defence Trai...
bycomputerbasedtrainin1
 
PDF
How to build hackthon projects from ZERO!
byishantyadav1111
 
PDF
Understanding Foldable 3-Wheel Electric Scooters for Everyday Use
byTopmate
 
PDF
Title Installing Windows, Linux, MacOS.pdf
byGeraldAbadajos
 
PDF
Rustici Software: eLearning standards in the age of AI
byRustici Software
 
PDF
Mesh WiFi Router: The Smart Solution for Fast, Seamless, Whole-Home Internet
byAeroMesh Systems
 
PDF
Traditional-Security-Models-No-Longer-Work.pptx (1).pdf
byOhhproJunction
 
PDF
Parental Control App for Phones_ The Complete 2026 Guide for Safer, Smarter P...
byRyan Cooper
 
PPTX
TechSprint Inauguration at SJB Institute of Technology held on 18 December 2025
bysuhasspgdg
 
ICT500 - CRITICAL AND CREATIVE THINKING FOR INFORMATION TECHNOLOGY SOLUTIONS:...
by2024432452
 
TechSprint WinterHack — Top 10 Teams Pitching Session we are excited for pit...
bybajpaitusharoffon678
 
AI and Zero Trust: What it takes to do it right
byMark Simos
 
UiPath Automation Developer Associate Training Series 2026 - Session 2
byDianaGray10
 
Writing GPU-Ready AI Models in Pure Java with Babylon
byAna-Maria Mihalceanu
 
Analyze and Preserve Logs - RHCSA (RH134).pdf
byLinuxCert Guru
 
UiPath Automation Developer Associate Training Series 2026 - Session 1
byDianaGray10
 
Track Phone Location via Number (2026)_ What Actually Works, What’s a Scam, a...
byEmily Woods
 
Beyond the Algorithm: Designing Human-Centric Public Service with AI
byAlan Dix
 
Introduction to Artificial Intelligence (AI).pptx
byammar414783
 
Dev Dives: Build and deploy agentic automations - the unified way
byUiPathCommunity
 
Computer-Based Training (CBT) The Backbone of Modern Technical & Defence Trai...
bycomputerbasedtrainin1
 
How to build hackthon projects from ZERO!
byishantyadav1111
 
Understanding Foldable 3-Wheel Electric Scooters for Everyday Use
byTopmate
 
Title Installing Windows, Linux, MacOS.pdf
byGeraldAbadajos
 
Rustici Software: eLearning standards in the age of AI
byRustici Software
 
Mesh WiFi Router: The Smart Solution for Fast, Seamless, Whole-Home Internet
byAeroMesh Systems
 
Traditional-Security-Models-No-Longer-Work.pptx (1).pdf
byOhhproJunction
 
Parental Control App for Phones_ The Complete 2026 Guide for Safer, Smarter P...
byRyan Cooper
 
TechSprint Inauguration at SJB Institute of Technology held on 18 December 2025
bysuhasspgdg
 

Carlos García - Pentesting Active Directory Forests [rooted2019]

  • 1.
  • 2.
    ciyinet CARLOS GARCÍA GARCÍA ComputerScience Eng. OSCP Penetration Testing Hack&Beers, Qurtuba… Organizer Co-author book Hacking Windows: Ataques a Sistemas y redes Microsoft PS C:> WHOAMI 2
  • 3.
    ciyinet WHAT ARE WE GOING TOTALK ABOUT? - Introduction to Active Directory Forests and Trusts - Why Pentesting Trusts? - Authentication Protocols across Trusts - Trusts enumeration - Common Attacks & Techniques - Reconnaissance across Trusts - Conclusions 3
  • 4.
    ciyinet FORESTS - Domains arestructured into trees and forests - A tree is a collection of related domains - A forest is a collection of trees that trust each others - Only one “Enterprise Admins” group per forest - Exists in root domain only - Non-existing in child domains - Added as local admin in child domain’s DCs 4
  • 5.
    ciyinet TRUSTS - Allow authenticationtraffic to flow between two domains - Establish the ability for users in one domain to authenticate to resources in another domain 5
  • 6.
    ciyinet TRUST DIRECTION - One-way -Domain B trusts A - Users in Domain A can access resources in Domain B. Users in domain B cannot access domain A - Two-way - Domain A trusts B, domain B trusts A - Authentication requests can be passed between the two domains in both directions 6
  • 7.
    ciyinet TRUST TRANSITIVITY Determines ifa trust can be extended outside of the two domains - Transitive - Extends trust relationship with other domains - Let a trusted domain pass through to a third domain - Non-transitive - Denies trust relationship with other domains 7
  • 8.
    ciyinet TYPE OF TRUSTS TypeDirection Transitivity Description Parent-Child 2-way Transitive Automatically established when a new domain is created in a tree Tree-Root 2-way Transitive Automatically established when a new tree is added to a forest. Between the new tree root and the forest root domain External 1-way or 2-way Non-transitive Manually created between a domain in a forest and another domain in a different forest that does not have a forest trust established Forest 1-way or 2-way Transitive Manually created between one forest root domain and another forest root domain Shortcut 1-way or 2-way Transitive Manually created between domains in the same forest that is used to shorten the trust path in a large and complex domain tree or forest and improve authentication times Realm 1-way or 2-way Transitive or Non-transitive Manually created between an AD domain and a non-Windows Kerberos V5 realm References: https://blogs.msmvps.com/acefekay/2016/11/02/active-directory-trusts 8
  • 9.
    ciyinet TRUSTS - All trustswithin the same forest are two-way and transitive - This is why all domains within a forest trust each other - Users from any domain can access resources in any other domain within the forest as long as: - They have the proper permissions assigned at the resource - They have network access 9
  • 10.
  • 11.
    ciyinet DIRECTION OF TRUSTVS ACCESS Domain A Trusted domain (inbound) Domain B Trustring domain (outbound) Direction of access Direction of trust 11
  • 12.
  • 13.
    ciyinet WHY PENTESTING TRUSTS? -Environments with trusts that were created many years ago without security in mind - Sometimes domain trusts introduce unintended access paths - Some domains (i.e. testing, development…) are not well maintained, controlled or monitored 13
  • 14.
    ciyinet WHY PENTESTING TRUSTS? Orsimply, what if your target is in a different domain? Reconnaissance Weaponisation and Exploitation Privilege Escalation & Lateral Movement Action on Targets Installation and Command & Control ▪ Email harvesting ▪ Social Networking ▪ IP Discovery ▪ Port Scanning ▪ Identify vulnerabilities ▪ Build and deliver malware via phishing, web, USB drive, network… ▪ Exploit a vulnerability to compromise the victim’s system ▪ Install malware ▪ Stablish persistence inside the environment ▪ Command channel for remote access ▪ Obtain more credentials ▪ Access other systems ▪ Escalate privileges ▪ Identify critical assets ▪ Data exfiltration ▪ Encryption of critical assets ▪ Service disruption ▪ Money $$$ References: Kroll Proactive Security Team 14
  • 15.
  • 16.
  • 17.
    ciyinet NTLM ACROSS TRUSTS 1.User requests access and sends DOMAIN-AUSERNAME Client in DOMAIN-A 2. Server sends challenge message 3. Client sends response message 4. Server sends DOMAIN-AUSERNAME challenge and response to DC in DOMAIN-B Server in DOMAIN-B DC in DOMAIN-B DC in DOMAIN-A References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc773178(v=ws.10) https://blogs.technet.microsoft.com/askpfeplat/2013/05/05/how-domain-controllers-are-located-across-trusts/ https://blogs.technet.microsoft.com/isrpfeplat/2010/11/05/optimizing-ntlm-authentication-flow-in-multi-domain-environments/ 8. Server sends authentication result to the client 7. Response to authenticate user 17
  • 18.
    ciyinet KERBEROS ACROSS TRUSTS Whena user requests access to a resource in a different domain: - User’s DC will not be able to issue a TGS of another domain as TGS can only be built using the target service’s password and DC only contain password data from security principals in their own domain - To solve this, the there is a trusts password between two domains in the same AD forest used as a bridge enable Kerberos authentication across trust 18
  • 19.
    ciyinet KERBEROS ACROSS TRUSTS Clientin DOMAIN-A 1. Request TGT (AS-REQ) 2. Receive TGT (AS-REP) Server in DOMAIN-B DC in DOMAIN-A DC in DOMAIN-B References: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc773178(v=ws.10) https://adsecurity.org/?p=1588 3. Present TGT, request TGS (TGS-REQ) 4. Receive inter-realm TGT (TGS-REP) Client encrypts a timestamp with their secret (hash/key) Client receives a TGT signed with the DOMAIN-A krbtgt account that proves they are who they say they are The TGT is then used to request TGS for specific resources/services on the DOMAIN-B DC sends a TGT for DOMAIN-B signed and encrypted using the inter-realm key DC sends a TGS ticket encrypted using the hash/key of the account that is associated with that service (SPN) The TGT is then used to request service tickets (TGS) for specific services on the domain. TGT I-R TGT TGS 19
  • 20.
  • 21.
    ciyinet TRUSTS ENUMERATION So weland in the organization; the exploitation path will depend on: - Domain you land on and its trusts - Privileges you manage to get in it - User’s privileges in foreign domains ? ? ? 21
  • 23.
  • 24.
    ciyinet TRUSTS ENUMERATION -NLTEST - Different information depending on where it’s executed from quarantined_domain = Filter_sids nltest /domain_trusts nltest /dclist:DOMAIN nltest /server:DC /trusted_domains 24
  • 25.
    ciyinet TRUSTS ENUMERATION -POWERVIEW - To enumerate trusts on a foreign domain, you need to able to bind to a DC (usually PDC) on the foreign domain* - Get-DomainTrust –SearchBase “GC://$($ENV:USERDNSDOMAIN)” - Return all forest trusts for the current forest or a specified forest Get-DomainTrust –Domain FOREIGN DOMAIN FQDN Get-ForestTrust –Domain FOREIGN DOMAIN FQDN 25
  • 27.
    ciyinet TRUST MAPPING PowerView BloodHound Get-DomainTrustMapping Invoke-BloodHound –CollectionMethodTrusts –SearchForest Invoke-BloodHound –CollectionMethod Trusts –Domain FOREIGN DOMAIN FQDN 27
  • 28.
    ciyinet Forest TRICIAForest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local TRUSTMAPPING Parent-Child trust Parent-Child trust assuan.local Tree-Root trust tricia.local Forest trust Forest CANETE canete.local External trust 28
  • 29.
    ciyinet Exploitation Path – CommonAttacks & Techniques PENTESTING ACTIVE DIRECTORY FORESTS
  • 30.
    ciyinet EXPLOITATION PATH Source (attacker’s location) Target domain Techniqueto use Trust relationship Root Child • Golden Ticket + Enterprise Admins group Inter-realm (2-way) Child Child • SID History exploitation Inter-realm Parent-Child (2-way) Child Root • SID History exploitation Inter-realm Tree-Root (2-way) Forest A Forest B • Printer bug + Unconstrained Delegation ? Intra-realm Forest or External (2-way) - Having Domain-Admin-level on the current domain: 30 - Not having Domain-Admin-level on the current domain: Reconnaissance + Exploitation (and always depending on type of trusts, direction and transitivity)
  • 31.
    ciyinet Forest CIYILAB ForestTRICIA ciyilab.local dev.ciyilab.local test.dev.ciyilab.local DA-LEVEL TECHNIQUES – ROOT TO CHILD Parent-Child trust Parent-Child trust assuan.local Tree-Root trust tricia.local Forest trust Forest CANETE canete.local External trust Golden ticket + EA group 31
  • 32.
    ciyinet ciyilab.local GOLDEN TICKET +ENTERPRISE ADMINS ciyilabciyi dc01 32 mimikatz.exe "kerberos::golden /domain:ROOT_DOMAIN_FQDN /sid:ROOT_DOMAIN_SID /krbtgt:ROOT_DOMAIN_KRBTGT_NT_HASH /user:USERNAME /groups:500,501,513,512,520,518,519 /ptt" Included by default. 519: RID of “Enterprise Admins” group
  • 34.
    ciyinet Forest TRICIAForest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local DA-LEVELTECHNIQUES – CHILD TO ROOT OR CHILD Parent-Child trust Parent-Child trust assuan.local Tree-Root trust tricia.local Forest trust Forest CANETE canete.local External trust SID history exploitation 34
  • 35.
    ciyinet SID HISTORY - Usedto migrate users from one domain to another - When a user is migrated, his old SID and all groups’ SIDs he’s a member of can be added to the attribute sidHistory - When the user tries to access a resource, his SID and the SIDs included in the sidHistory attribute are checked to grant/deny access - sidHistory is normally respected by domains within the forest. For external/forest trusts, they are filtered out by the “SID filtering” protection References: https://www.itprotoday.com/windows-78/exploiting-sidhistory-ad-attribute https://www.harmj0y.net/blog/redteaming/the-trustpocalypse/ https://gallery.technet.microsoft.com/migrate-ad-users-to-new-2e480804/ http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ 35
  • 36.
    ciyinet test.dev.ciyilab.local SID HISTORY HOPPING/EXPLOITATION testAdministrator srvproject 36 mimikatz.exe"kerberos::golden /domain:CHILD_DOMAIN_FQDN /sid:CHILD_DOMAIN_SID /krbtgt:CHILD_DOMAIN_KRBTGT_NT_HASH /user:USERNAME /sids:ENTERPRISE_ADMINS_GROUP_SID /ptt" Get it with PowerView: ConvertTo-SID -ObjectName "Enterprise Admins" -Domain ROOT_DOMAIN_FQDN
  • 38.
    ciyinet No Domain-Admin… Nofun? PENTESTING ACTIVE DIRECTORY FORESTS
  • 39.
    ciyinet EXPLOITATION PATH - HavingDomain-Admin-level in the domain you are: - Not having Domain-Admin-level on the current domain: Reconnaissance + Exploitation (and always depending on type of trusts, direction and transitivy) 39 Source (attacker’s location) Target domain Technique to use Trust relationship Root Child • Golden Ticket + Enterprise Admins group Inter-realm (2-way) Child Child • SID History exploitation Inter-realm Parent-Child (2-way) Child Root • SID History exploitation Inter-realm Tree-Root (2-way) Forest A Forest B • Printer bug + Unconstrained Delegation ? Intra-realm Forest or External trust (2-way)
  • 40.
    ciyinet RECONNAISSANCE 1. Enumerate truststhe current domain has and also trusts the other domains have 2. Enumerate objects: a. Enumerate security principals (i.e. users, groups, computers) in the current domain that have access to resources in another domain b. Enumerate groups that have users from another domain 3. Map exploitation path: what accounts need to be compromised to move from the current position to the target 40 References: http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/
  • 41.
  • 43.
    ciyinet Forest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local 1. TRUSTSENUMERATION Parent-Child trust Parent-Child trust Forest CANETE canete.local External trust 43
  • 44.
    ciyinet 2. OBJECT ENUMERATION Securityprincipals (users/groups) can be configured to have access to resources in another domain as: - Members of a local group in foreign machines - Look for foreign local group membership - Members of a domain group in a foreign domain - Look for foreign domain group membership - Principals in ACEs in a DACL - Look for foreign security principals in ACE in a foreign domain 44
  • 45.
    ciyinet TYPE OF GROUPS GroupVisibility (available to) Can have members from Same domain Other domains in same forest Domains outside the forest (forest or external trust) Functional memberships Local Local • Users • Computers • Domain local groups • Global groups • Universal groups • Users • Computers • Global groups • Universal groups • Users • Computers • Global groups • Users in the same forest • Users in other forests (foreign security principals) AD Domain local Domain (Cannot be used outside the domain they’ve been created in) • Users • Computers • Other Domain local groups • Global groups • Universal groups • Users • Computers • Global groups • Universal groups • Users • Computers • Global groups • Users in the same forest • Users in other forests (foreign security principals) AD Global Forest(s) • Users • Computers • Other Global groups None None Cannot have users of other domains AD Universal Forest(s) (Stored within the Global Catalog) • Users • Computers • Global groups • Other Universal groups • Users • Computers • Global groups • Other Universal groups None Users in the same forest References: https://www.youtube.com/watch?v=aPh8_RB8XEU 45
  • 46.
    ciyinet FOREIGN LOCAL GROUPMEMBERSHIP - Remote SAM (SAMR) or GPO correlation - Depending on current configuration (i.e. Windows firewall), in some cases we might need local admin privs on target to enumerate its local groups PowerView: Get-NetLocalGroup –ComputerName HOSTNAME Get-NetLocalGroupMemeber –ComputerName HOSTNAME -GroupName GROUP References: http://www.harmj0y.net/blog/redteaming/local-group-enumeration/ 46
  • 47.
    ciyinet Forest CIYILAB ciyilab.local dev.ciyilab.local test.dev.ciyilab.local 1. TRUSTSENUMERATION Parent-Child trust Parent-Child trust Forest CANETE canete.local External trust 47
  • 49.
  • 50.
  • 52.
  • 53.
  • 54.
    ciyinet FOREIGN USER MEMBERSHIP Enumerateusers in groups outside of the user’s domain. This can be used within the same forest PowerView: *Only Universal groups membership will be reflected Get-DomainForeignUser –Domain FOREIGN DOMAIN FQDN 54
  • 56.
    ciyinet FOREIGN GROUP MEMBERSHIP Enumerategroups in the target domain that contains users that are not from the target domain. This can be used against domain within the same forest or through a external/forest trust PowerView: Get-DomainForeignGroupMember –Domain FOREIGN DOMAIN FQDN 56
  • 57.
    ciyinet FOREIGN ACL PRINCIPALS 1.Enumerate DACLs (and their ACE entries) of all objects in domains that trusts yours 2. Only analyze ACE entries with foreign security principals This can be used against domain within the same forest or through a external/forest trust PowerView to list ACE entries with security principals from our domain: Get-DomainObjectAcl –Domain FOREIGN DOMAIN FQDN –ResolveGUIDs | Where-Object {$_.SecurityIdentifier –like ‘CURRENT_DOMAIN_SID*’} 57
  • 58.
    ciyinet 3. MAPPING EXPLOITATIONPATH – OBJECT ENUMERATION WITH BLOODHOUND BloodHound can enumerate trusts and objects in foreign domains (local and domain groups membership, ACLs, etc.) Invoke-BloodHound –SearchForest Invoke-BloodHound –Domain FOREIGN DOMAIN FQDN 58
  • 59.
  • 62.
  • 64.
  • 66.
  • 67.
    ciyinet WRAPPING UP –“METHODOLOGY” 1. Enumerate trusts the current domain has and also trusts the other domains have 2. Is the target within the same forest? Yes: step 3 No: steps 4 and 5 3. Got DA-level privileges in the current domain? Yes: use DA-level techniques No: steps 4 and 5 4. Enumerate objects: a. Security principals (i.e. user, groups, computers) in the current domain that have access to resources in another domain b. Groups that have users from another domain c. Foreign security principals in ACE in foreign domains 5. Map exploitation path What accounts need to be compromised to move from the current position to the target 67
  • 68.
  • 69.
    ciyinet CONCLUSIONS - If otherdomain trusts our domain, we can query their AD information - Trusts can introduce unintended access paths - Domain trust boundaries are not security boundaries - Losing control of the KRBTGT account password hash of any domain equates to losing control of the entire forest - You must reset KRBTGT (twice) in every domain in the forest! 69
  • 70.
    ciyinet BUSINESS RISK Compromise ofjust one Domain Admin account in the Active Directory forest exposes the entire organization to risk. The attacker would have unrestricted access to all resources managed by all domains, users, servers, workstations and data. Moreover, the attacker could instantly establish persistence in the Active Directory environment, which is difficult to notice and cannot be efficiently remediated with guarantees. “Once Domain Admin, always Domain Admin” “Once any Domain Admin, always Enterprise Admin” 70
  • 71.
    ciyinet ACKNOWLEDGMENT & REFERENCES -My brother (Happy B-DAY!!!) - Francisco Tocino - Nikhil Mittal (@nikhil_mitt) - Will Schroeder (@harmj0y) - Andrew Robbins (@_wald0) - Benjamin Delpy (@gentilkiwi) - Sean Metcalf (@PyroTek3) 71
  • 72.
  • 73.
  • 74.
  • 75.
    ciyinet PENTESTING ACTIVE DIRECTORY FORESTS ciyinetcarlos@ciyi.es CARLOS GARCÍA GARCÍA