Hi.
In this group of video lessons, we
will go through the most common Active Directory attacks
that adversary are using to compromise our environments.
These attacks are often used in escalation
in the environment where they can obtain higher privileges.
And unfortunately, often that leads
to gaining access to the main admin
account or similar privileges.
We will are also looking to common tools
that you can use to analyze your Active Directory that
can identify potential issues or misconfigurations that
can allow for such escalation.
We will begin by looking at some of the attacks.
And I just want to mention that the purpose of these videos
is not to really demonstrate the attacks
and how they are happening, but rather understand
what the attacks are, why are they possible,
and then discuss different preventions
that we can implement in order to either mitigate
the risk of these attacks or at least reduce
the risk of them being successful in our environment.
We will begin by discussing an attack called Kerberoasting,
and then we will move into a similar attack called
ASREPRoast.
Both attacks are related--
Or both attacks can be successful
if accounts have weak passwords set.
We'll discuss them in depth when we go into that specific video
module.
The next topic that we will discuss
is that often many administrators
tend to leave plaintext passwords that
could be either in scripts or in Active Directory
attributes, such as the descriptions of users
or groups, and so on.
We will look into that.
And I have to tell you, this is one
of the most common escalation paths you will identify.
And a common reason for that is because often, in environments,
one person would create a script and put a password into it.
And then another person will end up
sharing the folder without really understanding that there
is sensitive information in it.
And in many cases, since the organizations are big,
there is no good one central overview
to identify all of those shares being exposed.
We will then look into potential issues
with abusing local accounts, such as local administrator
account that exists by default on our enterprise workstations.
Because if we have the same password set
across multiple devices, one compromised device
will gain or will provide enough information to an attacker
to be able to laterally move between all our devices
that have the same account with the same password
to exist in them.
We will then move into discussing the issues
with Kerberos delegation, and why that is something
we need to know in our environment.
As you will find out soon, it's something that we really
also want to avoid.
So if possible, we try to avoid it to the very minimum.
Then we will look into Group Policy Preferences.
And especially, a bug which was introduced
because the encryption keys that were used to encrypt passwords
placed in GPO objects were essentially mistakenly leaked
on our Microsoft docs.
And by doing so, all passwords stored in GPOs
were essentially available to attackers,
basically out of the box.
Since we had the encryption keys,
from an attacker point of view, we
could go get the encrypted doc, decrypt it, and get
the passwords in plaintext.
And this happened 2014.
Microsoft has implemented patches ever since,
but there was no way to remove credentials
that already existed.
So if you have any old GPOs, this
is what we'll be looking at, identifying them and removing
credentials, if they contain any.
We will also look into an attack called DCSync.
And the core principle behind this attack
is that a user with sufficient permissions
can perform the maintenance of our application,
and essentially obtain Active Directory sensitive data,
such as password hashes.
We will afterwards start looking at some of the tools.
The first one is a tool called BloodHound, which is probably
the most popular tool in direct teaming world
when it comes to penetration testing Active Directory.
BloodHound will map your entire Active Directory.
All its users, groups, all the permissions
that they have over objects or membership of groups.
Everything that is nested in the entire tree,
you will be able to visualize it in a very nice diagram.
And to discuss BloodHound in depth,
we will perform a demonstration and you'll
get more familiar with it.
We will then look at another tool called
PingCastle, which is also one of my favorites, that
can perform hundreds of different checks
in your environment, and provide information on whether it finds
something to be weird, misconfigured, or just
recommends that it's being done in a different way.
A common misconfiguration, which I discover at customers,
is that certain GPOs can be modified by all users.
And of course, that is quite critical, especially
if these GPOs are linked to computers,
such as domain controllers or computers for domain admins
to login to.
Finally, we will look at a tool called New-ADReport, which
is a PowerShell script which will
extract the information about all users
and all computers in our directory
and save it to a CSV file.
That is really nice to have because, in a CSV file,
we can manipulate the data, we can filter out, we can remove.
And just having the overview in there, as you will later see,
can be really beneficial for us in the future.