Active Directory Kill Chain Attack & Defense

Сводка

Этот документ был разработан как полезный информационный ресурс для тех, кто хочет понять конкретные тактики, техники и процедуры (TTP), используемые злоумышленниками для компрометации Active Directory, а также руководство по смягчению последствий, обнаружению и предотвращению. А также понять Active Directory Kill Chain Attack и современную активность противников при постэксплуатации.

Содержание

• Discovery
• Privilege Escalation
• Defense Evasion
• Credential Dumping
• Lateral Movement
• Persistence
• Defense & Detection

---

Discovery

SPN Scanning

• SPN Scanning – Service Discovery without Network Port Scanning
• Active Directory: PowerShell script to list all SPNs used
• Discovering Service Accounts Without Using Privileges

Data Mining

• A Data Hunting Overview
• Push it, Push it Real Good
• Finding Sensitive Data on Domain SQL Servers using PowerUpSQL
• Sensitive Data Discovery in Email with MailSniper
• Remotely Searching for Sensitive Files
• I Hunt Sysadmins - harmj0y

User Hunting

• Hidden Administrative Accounts: BloodHound to the Rescue
• Active Directory Recon Without Admin Rights
• Gathering AD Data with the Active Directory PowerShell Module
• Using ActiveDirectory module for Domain Enumeration from PowerShell Constrained Language Mode
• PowerUpSQL Active Directory Recon Functions
• Derivative Local Admin
• Automated Derivative Administrator Search
• Dumping Active Directory Domain Info – with PowerUpSQL!
• Local Group Enumeration
• Attack Mapping With Bloodhound
• Situational Awareness
• Commands for Domain Network Compromise
• A Pentester’s Guide to Group Scoping

LAPS

• Microsoft LAPS Security & Active Directory LAPS Configuration Recon
• Running LAPS with PowerView
• RastaMouse LAPS Part 1 & 2

AppLocker

• Enumerating AppLocker Config

Active Directory Federation Services

• 118 Attacking ADFS Endpoints with PowerShell Karl Fosaaen
• Using PowerShell to Identify Federated Domains
• LyncSniper: A tool for penetration testing Skype for Business and Lync deployments
• Troopers 19 - I am AD FS and So Can You

---

Privilege Escalation

BadSuccessor

• BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory
• Operationalizing the BadSuccessor: Abusing dMSA for Domain Privilege Escalation

sAMAccountName Spoofing

• sAMAccountName spoofing
• CVE-2021-42287/CVE-2021-42278 Weaponisation

Abusing Active Directory Certificate Services

• Certified Pre-Owned
• AD CS Domain Escalation

PetitPotam

• PetitPotam
• From Stranger to DA // Using PetitPotam to NTLM relay to Domain Administrator

Zerologon

• Cobalt Strike ZeroLogon-BOF
• CVE-2020-1472 POC
• Zerologon: instantly become domain admin by subverting Netlogon cryptography (CVE-2020-1472)

Passwords in SYSVOL & Group Policy Preferences

• Finding Passwords in SYSVOL & Exploiting Group Policy Preferences
• Pentesting in the Real World: Group Policy Pwnage

MS14-068 Kerberos Vulnerability

• MS14-068: Vulnerability in (Active Directory) Kerberos Could Allow Elevation of Privilege
• Digging into MS14-068, Exploitation and Defence
• From MS14-068 to Full Compromise – Step by Step

DNSAdmins

• Abusing DNSAdmins privilege for escalation in Active Directory
• From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration

Kerberos Delegation

• Constructing Kerberos Attacks with Delegation Primitives
• No Shells Required - a Walkthrough on Using Impacket and Kerberos to Delegate Your Way to DA
• CVE-2020-17049: Kerberos Bronze Bit Attack – Overview