Active Directory Kill Chain Attack & Defense

Résumé

Ce document a été conçu pour être une ressource utile et informative pour ceux qui cherchent à comprendre les tactiques, techniques et procédures (TTP) spécifiques que les attaquants utilisent pour compromettre Active Directory, ainsi que des conseils pour l'atténuation, la détection et la prévention. Et comprendre la chaîne de kill Active Directory et l'activité de l'adversaire moderne en post-exploitation.

Table des matières

• Discovery
• Privilege Escalation
• Defense Evasion
• Credential Dumping
• Lateral Movement
• Persistence
• Defense & Detection

---

Discovery

Analyse SPN

• SPN Scanning – Service Discovery without Network Port Scanning
• Active Directory: PowerShell script to list all SPNs used
• Discovering Service Accounts Without Using Privileges

Exploration de données

• A Data Hunting Overview
• Push it, Push it Real Good
• Finding Sensitive Data on Domain SQL Servers using PowerUpSQL
• Sensitive Data Discovery in Email with MailSniper
• Remotely Searching for Sensitive Files
• I Hunt Sysadmins - harmj0y

Recherche d'utilisateurs

• Hidden Administrative Accounts: BloodHound to the Rescue
• Active Directory Recon Without Admin Rights
• Gathering AD Data with the Active Directory PowerShell Module
• Using ActiveDirectory module for Domain Enumeration from PowerShell Constrained Language Mode
• PowerUpSQL Active Directory Recon Functions
• Derivative Local Admin
• Automated Derivative Administrator Search
• Dumping Active Directory Domain Info – with PowerUpSQL!
• Local Group Enumeration
• Attack Mapping With Bloodhound
• Situational Awareness
• Commands for Domain Network Compromise
• A Pentester’s Guide to Group Scoping

LAPS

• Microsoft LAPS Security & Active Directory LAPS Configuration Recon
• Running LAPS with PowerView
• RastaMouse LAPS Part 1 & 2

AppLocker

• Enumerating AppLocker Config

Services de fédération Active Directory

• 118 Attacking ADFS Endpoints with PowerShell Karl Fosaaen
• Using PowerShell to Identify Federated Domains
• LyncSniper: A tool for penetration testing Skype for Business and Lync deployments
• Troopers 19 - I am AD FS and So Can You

---

Privilege Escalation

BadSuccessor

• BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory
• Operationalizing the BadSuccessor: Abusing dMSA for Domain Privilege Escalation

Usurpation de sAMAccountName

• sAMAccountName spoofing
• CVE-2021-42287/CVE-2021-42278 Weaponisation

Abus des services de certificats Active Directory

• Certified Pre-Owned
• AD CS Domain Escalation

PetitPotam

• PetitPotam
• From Stranger to DA // Using PetitPotam to NTLM relay to Domain Administrator

Zerologon

• Cobalt Strike ZeroLogon-BOF
• CVE-2020-1472 POC
• Zerologon: instantly become domain admin by subverting Netlogon cryptography (CVE-2020-1472)

Mots de passe dans SYSVOL et préférences de stratégie de groupe

• Finding Passwords in SYSVOL & Exploiting Group Policy Preferences
• Pentesting in the Real World: Group Policy Pwnage

MS14-068 Vulnérabilité Kerberos

• MS14-068: Vulnerability in (Active Directory) Kerberos Could Allow Elevation of Privilege
• Digging into MS14-068, Exploitation and Defence
• From MS14-068 to Full Compromise – Step by Step

DNSAdmins

• Abusing DNSAdmins privilege for escalation in Active Directory
• From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration

Délégation Kerberos

• Constructing Kerberos Attacks with Delegation Primitives
• No Shells Required - a Walkthrough on Using Impacket and Kerberos to Delegate Your Way to DA
• CVE-2020-17049: Kerberos Bronze Bit Attack – Overview