Download to read offline
![CONFIDENTIAL INFORMATION
• Enumerate all users with data in the SID History attribute which include SIDs in the same domain.
• If users haven’t been migrated, search for all users with data with the SIDHistory attribute.
DETECTION TECHNIQUES
27
# Detect Same Domain SID History
Import-Module ActiveDirectory
[string]$DomainSID = ( (Get-ADDomain).DomainSID.Value )
Get-ADUser -Filter “SIDHistory -Like ‘*'” -Properties SIDHistory | `
Where { $_.SIDHistory -Like “$DomainSID-*” }
Domain Controller Events:
• 4765: SID History was added to an account.
• 4766: An attempt to add SID History to an account failed.](https://image.slidesharecdn.com/morezbangforthezbuck-180719214722/85/More-zBang-for-the-zBuck-27-320.jpg)
Uploaded byAndy Thompson
More zBang for the zBuck
Andy Thompson presented on how the zBang tool can be used to discover hidden risks in an Active Directory environment. The tool detects shadow admins, checks for skeleton key malware infections, analyzes SID history for privilege escalation risks, identifies risky SPNs, and allows querying Active Directory to find unusual configurations. zBang scans can be run from any domain-joined machine with read-only access to domain controllers and typically completes within 7-10 minutes for an environment with 1000 machines.
![Carlos García - Pentesting Active Directory [rooted2018]](https://cdn.slidesharecdn.com/ss_thumbnails/carlosgarcia-slides-180312234839-thumbnail.jpg?width=640&height=640&fit=bounds)
More zBang for the zBuck
- 1. CONFIDENTIAL INFORMATION MORE zBANGFOR THE zBUCK 1 How zBang Can Be Used to Discover Hidden Risks Andy Thompson – Customer Success
- 2. CONFIDENTIAL INFORMATION • NationalManager – Customer Success • Dallas, TX • Husband • Father • Road-warrior WHOAMI 2
- 3. CONFIDENTIAL INFORMATION 3 IfI have seen further than others it is by standing upon the shoulders of giants. - Isaac Newton
- 4.
- 5. CONFIDENTIAL INFORMATION •Hidden Risks •ShadowAdmins •Skeleton Key Attacks •SID History •Risky SPN’s •zBang! AGENDA 5
- 6.
- 7. CONFIDENTIAL INFORMATION Overlooked privilegedaccounts. • Not members of a privileged Active Directory Group. • Privileges granted through the direct assignment of permissions using ACLs on AD Objects. SHADOW ADMINS 7https://www.cyberark.com/threat-research-blog/shadow-admins-stealthy-accounts-fear/
- 8. CONFIDENTIAL INFORMATION DEMONSTRATION 8 Normal usercan’t access ms-mcs-AdmPwd FAIL!
- 9. CONFIDENTIAL INFORMATION DEMONSTRATION 9 Privileged attackeradds backdoor to Servers OU
- 10. CONFIDENTIAL INFORMATION DEMONSTRATION 10 Domain usercan access AdmPwd! LAPS cmdlet doesn’t detect it! SUCCESS!
- 11. CONFIDENTIAL INFORMATION An ACEup the sleeve 11 Designing Active Directory DACL Backdoors Andy Robbins & Will Schroder SpectreOps
- 12. CONFIDENTIAL INFORMATION • Prevention: •None. Pretty much your only hope for performing “forensics” on these actions. • If you weren’t collecting logs when backdoored, you may never know who the perp was :( • Detection • Proper event log tuning and monitoring • Pro-Tip: Event log 4738 (“A user account was changed”), filtered by the property modified. • Replication Metadata • Points you in the right direction, but you still need full logs. • System Access Control Lists (SALC’s) • Contain entries that, “specify access attempts and generate audit records in the event log of a domain controller”. • More info at http://bit.ly/2tOAGn7 MITIGATION TECHNIQUES 12
- 13. CONFIDENTIAL INFORMATION Allows theorganization to review privileged accounts that might not be part of the organizations' known privileged groups but still may have sensitive permissions. https://github.com/cyberark/ACLight Developed by Asaf Hecht @HechtovZBANG ACLIGHT 13
- 14.
- 15. CONFIDENTIAL INFORMATION • Discoveredin the wild – Jan 2015. • Bypasses authentication on Active Directory (AD) systems. • Threat actors can authenticate as any user. • Does not generate network traffic. • Network Intrusion Protection is USELESS! SKELETON KEY MALWARE 15
- 16. CONFIDENTIAL INFORMATION • Deployedas in-memory patch on victim’s AD Domain Controller. • Downgrades encryption from AES128|256 to RC4 • Affects DC Replication • Lacks persistence! SKELETON KEY MALWARE 16
- 17.
- 18.
- 19. CONFIDENTIAL INFORMATION • EnableMulti-Factor Authentication • Isolate critical infrastructure • Limit Privileged User Accounts. MITIGATION TECHNIQUES 19
- 20. CONFIDENTIAL INFORMATION Queries allDC’s in forest and tries to connect through Kerberos with AES256 encryption. ZBANG SKELETON KEY SCAN 20 If DC is running the correct functional level and not supporting AES256 encryption, it might be infected.
- 21.
- 22. CONFIDENTIAL INFORMATION • Attributethat can be used in case of migration of an account between two trusted domains. • The attribute can be manipulated by attackers to escalate privileges. SID HISTORY 22 SID: 5-1-5-21-1583770191-1400084446-32828441-3103 SID: 3-2-6-49-1547894215-1597538462-15985214-1541 SID: 3-2-6-49-1547894215-1597538462-15985214-1541 SIDHISTORY: 3-2-6-49-1547894215-1234567890-98765432-1351 SIDHISTORY: 5-1-5-21-1583770191-1400084446-32828441-3103
- 23. CONFIDENTIAL INFORMATION PRIVILEGED SIDS 23 Name SID AdministratorS-1-5-21 Domain – 500 KRBTGT S-1-5-21 Domain - 502 Enterprise Domain Controllers S-1-5-9 Domain Admins S-1-5-21 Domain - 512 Domain Controllers S-1-5-21 Domain - 516 Schema Admins S-1-5-21 Domain - 518 Enterprise Admins S-1-5-21 Domain - 519 Group Policy Creator Owners S-1-5-21 Domain - 520 Administrators S-1-5-32-544 Account Operators S-1-5-32-548 Server Operators S-1-5-32-549 Print Operators S-1-5-32-550 Backup Operators S-1-5-32-551 Replicators S-1-5-32-552 Event Log Readers S-1-5-32-573
- 24. CONFIDENTIAL INFORMATION DEMONSTRATION 24 Adding DomainAdmin rights within SID History
- 25. CONFIDENTIAL INFORMATION DEMONSTRATION 25 User nowhas Domain Admin Rights.
- 26. CONFIDENTIAL INFORMATION DEMONSTRATION 26 Dump KRBTGT(Golden Ticket)
- 27. CONFIDENTIAL INFORMATION • Enumerateall users with data in the SID History attribute which include SIDs in the same domain. • If users haven’t been migrated, search for all users with data with the SIDHistory attribute. DETECTION TECHNIQUES 27 # Detect Same Domain SID History Import-Module ActiveDirectory [string]$DomainSID = ( (Get-ADDomain).DomainSID.Value ) Get-ADUser -Filter “SIDHistory -Like ‘*'” -Properties SIDHistory | ` Where { $_.SIDHistory -Like “$DomainSID-*” } Domain Controller Events: • 4765: SID History was added to an account. • 4766: An attempt to add SID History to an account failed.
- 28.
- 29.
- 30. CONFIDENTIAL INFORMATION • SPNis a unique identifier of a service instance. • Used by Kerberos to associate a service instance to a service logon account. • Computer • User • Stored in Active Directory…Whether it exists or not! RISKY SPN’S 30
- 31.
- 32. CONFIDENTIAL INFORMATION 32 AttackingKerberos: Kicking the Guard Dog of Hades Tim Medin SANS Hackfest 2014
- 33. CONFIDENTIAL INFORMATION DEMONSTRATION 33 Search forVulnerable SPN’s
- 34.
- 35. CONFIDENTIAL INFORMATION DEMONSTRATION 35 Brute-force theKerberos Ticket
- 36. CONFIDENTIAL INFORMATION DEMONSTRATION 36 In asingle command… PS C:> Find-PotentiallyCrackableAccounts - Sensitive -Stealth -GetSPNs | Get-TGSCipher - Format "Hashcat" | Out-File crack.txt | Hashcat64.exe -m 13100 crack.txt -a 3
- 37. CONFIDENTIAL INFORMATION • Deleteunused SPN’s, disable unused accounts. • Often overlooked. • Avoid Dual-accounts. • Used by both human users and services. • Strengthen encryption types. Switch to AES • Least Privileged approach. • Consider local accounts, computer accounts, virtual, or ephemeral accounts. • Rotated, random, and complex credentials. • Use an automated system, or at least employ managed service accounts. • Avoid hardcoded credentials – use credentials management. (AIM/Conjur) • Monitor usage of privileged accounts. • Specific useage of service accounts • Large quantities of Service Ticket requests (Event ID 4769) MITIGATION TECHNIQUES 37
- 38. CONFIDENTIAL INFORMATION Scans thedomain controller for deployed services running with high privileged human accounts. ZBANG RISKYSPN 38 Those services can be targeted by infiltrating attacker to extract credentials utilize the privileged account for malicious purposes.
- 39. CONFIDENTIAL INFORMATION SPN DELEGATION 39 •Services and Service Accounts can introduce more risk than you think. • Service Delegation is abused for PrivEsc and RCE • Matan Hart @MachoSec
- 40. CONFIDENTIAL INFORMATION MYSTIQUE 40 Queries theActive Directory for accounts that are trusted for delegation (Unconstrained, Constrained and Protocol Transition). https://github.com/machosec/Mystique Identifies risky Kerberos delegation configurations.
- 41. CONFIDENTIAL INFORMATION The zBangtool suite was developed by CyberArk Labs to allow organizations a quick detection of recent dangerous risks and vulnerabilities exploited by attackers. This FREE tool suite will detect risks and potential attacks in your network.zBANG 41 Typical Execution (1000 machines) = Roughly 7-10 min.
- 42. CONFIDENTIAL INFORMATION • Powershellv3+ and .NET 4.5 • (Default in Windows 8/2012+) • Run the tool from a domain joined machine. • Run it with any domain user account. • Only Read-Only queries to the DC. SYSTEM REQUIREMENTS 42
- 43. CONFIDENTIAL INFORMATION •Run ittoday! • Reach out to your local CS Advisor! •Deeper Audits available too! WANT MORE ZBANG?! 43
- 44. CONFIDENTIAL INFORMATION •Hidden Risks •ShadowAdmins •Skeleton Key Attacks •SID History •Risky SPN’s •zBang! SUMMARY 44
- 45.
Editor's Notes
- #29 The SID history attribute is an attribute that can be assigned to each domain account and can be used in case of migration of an account between two trusted domains. The attribute can be manipulated by attackers to escalate privilege.
- #41 This module can assist blue teams to identify risky Kerberos delegation configurations as well as red teams to impersonate arbitrary users by leveraging KCD with Protocol Transition