Hi Welcome to this video lesson on Ping Castle.
Ping Castle is a tool, which is going to scan
your entire environment.
And then create a report, with all the findings
that it has on misconfigurations or certain heartening
recommendations that the tool can provide.
The report that the tool generates is--
it consists of two different parts.
The first part showcases on a high level,
the risk level towards the domain,
or your environment and the second level
is the different technical detection's and recommendations
that the tool comes up with.
So when, when Ping Castle scans your environment,
It will extract information about computers and users.
And then provide information about--
for example one was passwords or other one--
If there were any initiatives that the password hasn't been
changed in the past three years, or if there's
any Stale objects like computer accounts
that haven't logged in the past in years,
but they're still active and enabled.
Like general things for management active--
managing active directory.
It will also look into some common issues,
such as the one that we discussed previously,
specifically the group policy preferences passwords, it
will check whether SMBv1 version or the Spooler service
is running domain controllers.
Is going to report on all these small things.
It will also look into access control list misconfigurations.
For example, if domain users or authenticated users.
The everyone group if they have been given any rights
for example, if they have any rights towards changing a GPO
or changing a file that a GPO is deploying to all workstations
and so on.
It will check for example, if LAPS is installed
and the amount of checks is really massive for us
to cover in this presentation, the best way
to really understand the tool is by executing it and then
looking into all the different things that it detects.
And that is the best way because it's constantly being improved,
the developers are releasing new versions rather often.
So what we can cover in here, or what we're not
going to showcase, Is most likely not in the tool yet,
but it might come in the future.
But then again the current list is really massive.
And let's take an example here.
If I remember in the high overview report which
I was showing earlier here the different,
the four different categorizations
Stale objects, trust, first accounts and anomalies.
So just to take some of them, I wanted
to showcase the different findings
that the two has for each of the different categorizations.
For example for the first accounts.
It detects that, there are some 19
accounts at unconstrained delegations configured
in our domain.
There's also a constraint delegation configured
towards a domain controller.
And this risk I outlined earlier in Keberos delegation.
Where an account with delegation [INAUDIBLE]
can basically impersonate anyone else the entire domain.
That could be really bad.
And then this too will go undetected
if this exists in our environment or not.
It will also check if the flag--
this account is sensitive and cannot be delegated,
is set to our closed accounts.
It's also looking if service accounts or an accounts that
have an SPN set are also privileged.
And there is the case in here, where
it says at least one member of an administrative group
could potentially be vulnerable to the Kerberos attack.
And so on.
The list continues it's really hundreds and hundreds of things
that the tool can detect.
For anomalies, it would look into when
was the last time that the Kerberos password or Kerberos
DGT password was changed.
This is a topic, which I have not--
which we have not discussed yet in the course,
but we'll come back to it later on.
It also shows that it discovered two passwords in GPOs
and this is exactly the group policy preferences
passwords, that we had discussed previously.
There were two passwords that were stored in there,
which the tool discovered.
It will also see that the Spooler Service is running
on a 404 domain controllers, and that's a good, good thing
to outline because that's one of the services which we really
want to disable the main controllers.
And the reason for that, is because it
can really, really easily be abused
with unconstrained delegation, which
is exactly what we did earlier when we were discussing
Kerberos delegation.
And then I also wanted to look at the Stale objects rules.
Here it's going to detect whether we
have presence of systems that are no longer supported
by their vendors.
And what we're going to see here is
examples of Windows 2000, Windows 2003 servers,
Windows XP.
It detects that there are users in our active directory, whose
primary group is not domain users.
That's also something that's going to detect on.
This is something that we also want
to know about, because if we had certain GPOs that we want
to apply startup scripts or something on domain users,
unless these users were manually added to domain users
afterwards, the GPO would just not apply on them,
because the normal group is not domain users.
So that's something to be aware of
and again tool check it up as well.
The last finding here that I want to discuss
was the last one, which is non admin
users that can add up to--
that can add up two computers to domain.
The default in every domain, is that every user can add up
to ten computers to a domain.
And that is really against best practice
because you shouldn't let users domain join machines,
rather it should only be those specific accounts
that require this privilege.
So domain administrators and one or two
accounts that are associated with a system or other tools
that you might have for domain joining new devices.
The finding here is that every user could domain
join two computers.
And while it's not the default ten,
it's still bad it shouldn't be there.
Let's go into the environment, and I want to just showcase
how to execute Ping Castle.
One thing to be aware of is that Ping Castle is not
the free tool.
There is a free version for experimenting
with getting used to the tool.
But if you want to use it in an enterprise environment,
you have to pay the license for that tool.
Let's move to the environment and do a quick execution just
to see how easy it is to get the data out.
I just connected to the environment.
And I already downloaded the what the Ping Castle tool.
I will go forward and extract this zip
file, when extracted let's navigate inside the folder.
In here, other than the executable file,
we'll discover a few other files which can tell us
how to use the tool itself.
We're going to omit them, omit them at this point
and just focus on the executable file.
We're going to run the executable file from a Power
Shell prompt, so I'll start Power Shell
and then type the executable name, which is pingcastle.ac
Now when you run the tool, it will
ask you to choose an option which to proceed.
Option number one is health checks score,
then you have different checks that you can perform,
if you want to go more [INAUDIBLE]..
For this specific test, we'll just go with option one,
and simply press enter to proceed forward with.
Now we get prompted to specify the domain name that we want
investigate, and it detects the current one
that the user is going to look into.
In this case, there is ELS bank, and this is a domain
that you want to scan.
So we're going to just go forward and press enter again.
Now data gathering has started, and depending
on how big the environment is this tool might take
a couple of minutes to execute as what you're
going to see in here in a small environment like mine,
it will just take a couple of seconds
and we'll have all the data collected then
ready to be displayed back to us.
It's gathering data about many different arch, arch,
and arch directory and then ensembles the final report,
with all of them being present.
And what we're seeing on the screen now,
is that the actual final report is already done.
And we can see it, in the same folder as dedicatable.
And the new name is an HTML document.
In this case, it is called a- g- h- s- the domain name dot HTML.
So let's go forward and open this file.
Immediately we get presented with the nice report
of all the different indicators of risk
levels in our environment, or the four different ones
that we discussed already in the slides.
It tells us that, the overall risk for our domain
is 80 out of 100.
And then it shows us the different--
four categories which assemble data for.
You will see that the overall domain risk level, will always
be the same as the highest one that it has
detected in these four areas.
And in this case it is 80 out of 100,
because that is the score under the previous account.
So if we go further down, we can see the actual findings
that this tool has detected.
So under Stale objects we'll see the we
have non admin users can add up to ten computers to the domain.
Another interesting one is, number of accounts which do not
required Keberos specification is one.
We can actually press on this, to get
a very detailed descriptive information about defining
itself, some technical explanation behind it
and a potential solution that the developers of this tool
have advised.
But what is also more important here
is that, it also show us immediately the account,
which was found to be vulnerable to this specific finding.
Now if we go further down in Privileged accounts
we'll see that.
It gives us an estimate that everyone
can take control of a key domain object,
by abusing targeted permissions.
This finding if we look further into it,
is essentially telling us that every domain object user
computer, will has the ability to hijack a path domain
identity.
It could be, for example there's a path
for escalation to the domain admin centres.
The next one is telling us that, there is a GPO item that
can be manipulated by any user.
If I expand this, we'll see the information
for this specific GPO.
It will tell us that there's a GPO which is lapse decoy,
and authenticated users in the domain
have full control over this GPO.
And this is really bad, this is one
of those findings which we really have to rush and go fix
immediately because if this is linked to a device where
the previous user is logging in or accessing that could really
end up being full domain compromise for us.
And of course something that we want to avoid.
Scrolling further down we'll see other information
about the domain.
Some of them are really informative
like unconstrained delegations are configured on one domain
account.
When unconstrained delegation is one of those flaws
which we discussed and it's really bad, but in many cases
it's required to be used.
So the tool just sluggish--
back, back to us that there's an account, which
has disconfigured.
So it's up to us at this point to decide,
does this account actually need this permission or not.
Because if it doesn't we need to do a clean up and simply remove
these permissions.
There's also some trust which were identified
in the mine and some anomalies.
What we're going to see here and probably interesting for you
we already discussed is that, the Spooler service is running
on domain controllers, and password policies for service
accounts have not been found.
And the tool recommends that these password policies should
be at least 20 characters, but our recommendation
was 100 or more.
Scrolling further down the report port
we'll get a very detailed information about users,
about groups.
How many of them are active, how many of them
are disabled, logged and very rich
detailed information, about our entire domain.
In here, for example, we can see an overview
of how many users are members, of the previous groups.
How many of them are enabled, how many are disabled,
inactive and so on.
It could be really, really valuable use information.
When we have all delegations, it will
show us delegations on organizational units.
So in here we can see that the account
Rooney, has full control over admin as the holder.
And this is again one of those really
configurations because what this means is that, Rooney will not
only have the ability to modify the OU codes
admin as the holder, but having the ability
over this specific object, also gives you the same ability
over previous groups.
So because Rooney is set to modify admin as the holder
he is going to inherit, that he can also go and modify
the group for example domain admins
and that's absolutely crazy.
Then scrolling further down, we'll
just continuously get the rich information
that this tool gives back to us about the rest of domain.
I'll scroll all the way down, and they'll
show you what they're really like in here as well.
Is that it will give us an overview of all the files
that GPOs are deploying.
In this case, there's only one file, which a GPO is deploying.
And what is interesting is that, it just
happens to be the same GPO, that we
discovered every authenticated users can go and modify.