Downloaded 117 times
Uploaded byAndy Robbins
Here Be Dragons: The Unexplored Land of Active Directory ACLs
This document summarizes information about three individuals - Andy, Rohan, and Will - who work at Specter Ops creating security tools like BloodHound. It provides details on their jobs, tool development experience, conference presentations, training experience, and Twitter accounts. It then outlines abuse primitives that can be exploited through misconfigurations in Active Directory object ACLs. Finally, it demonstrates how to use tools like PowerView, SharpHound, and BloodHound to find misconfigurations and attack paths in Active Directory.
More Related Content
Similar to Here Be Dragons: The Unexplored Land of Active Directory ACLs
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Here Be Dragons: The Unexplored Land of Active Directory ACLs
- 2. About Us: Andy •Job: Adversary Resilience Lead at Specter Ops • Tool creator/dev: BloodHound • Presenter: DEF CON, ekoparty, Black Hat Arsenal, BSidesLV, BSidesSeattle, ISSA Intl, ISC2 World Congress • Trainer: Black Hat USA, Black Hat Europe, Adversary Tactics: Red Team Operations • Twitter: @_wald0
- 3. About Us: Rohan •Job: Director of Technology at Specter Ops • Tool creator/dev: BloodHound, EyeWitness, Empire, etc. • Presenter: DEF CON, ekoparty, Black Hat Arsenal, BSidesLV, BSidesDC, BSidesDE • Trainer: Black Hat USA • Twitter: @CptJesus
- 4. About Us: Will •Job: Offensive Engineer at Specter Ops • Tool creator/dev: BloodHound, Veil-Framework, PowerView, PowerUp, Empire • Presenter: Cons on cons on cons • Trainer: Black Hat USA, Adversary Tactics: Active Directory, Adversary Tactics: Red Team Operations • Twitter: @harmj0y
- 6. Outline • Prior Work •Why care about this? • ACL Background • Abuse Primitives • Finding Misconfigs and Attack Paths • BloodHound Interface Demo • Complex ACL Attack Path Demo
- 7.
- 8. Prior Work • Heat-ray:Combating Identity Snowball Attacks Using Machine Learning, Combinatorial Optimization and Attack Graphs John Dunagan, Alice X. Zheng, Daniel R. Simon http://bit.ly/2qG0OvE • Active Directory Control Paths Lucas Bouillot, Emmanuel Gras, Geraud de Drouas http://bit.ly/1pBc8FN
- 9. Prior Work • ActiveDirectory ACL Scanner Robin Granberg http://bit.ly/2faPdkz • Airbus BTA Philippe Biondi, Joffrey Czarny http://bit.ly/2faFFpX • Several AD ACL related blog posts Sean Metcalf https://adsecurity.org/?tag=ad-acls
- 10.
- 11. Why care? (partI) • Lack of awareness of impact from third party software/sysadmins • “Misconfiguration debt” from earlier installs, sometimes since your domain was stood up • General lack of defender awareness at impact/importance • Difficulty of auditing (especially at scale)
- 12. Why care? (partII) • Any authenticated user (by default) can enumerate these DACLs • Communication in nearly all cases is limited to the DC • Execution may not require pivoting to other systems at all! • Completely different forensic profile that most orgs are not prepared for
- 16.
- 17. ACL Background • Allsecurable objects in Windows and Active Directory have a Security Descriptor. • The Security Descriptor has a DACL and a SACL • The DACL is populated by ACEs, which define what permissions other objects do or do not have against an object.
- 22. ACL Background • Thoseare just the very basic moving parts of ACLs and the Windows security model. • For way more in-depth info, see our 67 page white paper from Black Hat this year here: https://specterops.io/assets/resources/an_ace_up_th e_sleeve.pdf
- 23.
- 24. The ability tochange a user password without knowing the current password ForceChangePW Abuse cmdlet: Set-DomainUserPassword Cleanup method: mimikatz lsadump::setntlm
- 25. The ability toadd any other user, group, or computer to a group. AddMembers Abuse cmdlet: Add-DomainGroupMember Cleanup cmdlet: Remove-DomainGroupMember
- 26. Full object controlover user and group objects GenericAll Abuse cmdlets: Add-DomainGroupMember, Set- DomainUserPassword, Set-DomainObject & Kerberoast Cleanup cmdlets and method: Remove-DomainGroupMember, mimikatz lsadump::setntlm, Set-DomainObject -Clear
- 27. The ability towrite any object property value GenericWrite Abuse cmdlets: Add-DomainGroupMember Set-DomainObject & Kerberoast Cleanup cmdlets and method: Remove-DomainGroupMember, Set-DomainObject -Clear
- 28. The ability togrant object ownership to another principal WriteOwner Abuse cmdlet: Set-DomainObjectOwner Cleanup cmdlet: Set-DomainObjectOwner (back to what it was before)
- 29. The ability toadd a new ACE to the object’s DACL WriteDACL Abuse cmdlet: Add-DomainObjectACL Cleanup cmdlet: Remove-DomainObjectACL
- 30. The ability toperform any “extended right” function AllExtendedRights Abuse cmdlets: Add-DomainGroupMember, Set- DomainUserPassword, Set-DomainObject & Kerberoast Cleanup cmdlets and method: Remove-DomainGroupMember, mimikatz lsadump::setntlm, Set-DomainObject -Clear
- 31.
- 32. Finding Attack Opportunities •Howto use PowerView for singular object ACL inspection – the domain object is a good candidate here •How to use SharpHound collector to gather ACLs for all objects •How to use BloodHound to find attack paths
- 33. Finding Attack Opportunities •While graph theory is the best approach for modeling the entire system, one-off analysis can still be useful • PowerView’s Get-DomainObjectAcl is our go-to for specific object enumeration and verification of BloodHound results • -ResolveGuids helps resolve GUID rights to human readable form :)
- 34.
- 35. Foreign GPO EditRights
- 36. SharpHound •A complete rewriteof the PowerShell Ingestor into C# •Lots of new features •Massive performance increases •Lots of bugs fixed •Completely fixed memory usage (200-250mb tops)
- 37. SharpHound •More and betterthreading! •Modular stealth enumeration! •Session Looping •Caching •Progress Output! (!!!!!!!!) •Locale independent Local Admin enumeration
- 38. SharpHound – SpeedImprovements
- 39. SharpHound •For a fulltechnical write-up and usage guide, see Rohan’s blog post here: http://bit.ly/2xVVoVc
- 40. Old Ingestor NewIngestor
- 41. Special Shoutout Thank youto all the users in the BloodHound slack channel participating in the beta. Your help has been invaluable!
- 42.
- 43.
- 44.
- 45.
- 46. Future Work •More optionsfor taking over computer objects •Set a temporary fine grained password policy on a single user to bypass NT history and minimum age check •GPOs…soon!
- 47. Thank You! • Weare @_wald0, @CptJesus and @harmj0y - https://www.specterops.io • Thank you to the BloodHound community for your support, ideas and beta testing SharpHound. Get BloodHound at https://bit.ly/GetBloodHound and SharpHound at http://bit.ly/SharpHound • Join the BloodHound Slack at https://bloodhoundgang.herokuapp.com