Vulnerabilities / Threats

8/17/2018
01:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Exploring, Exploiting Active Directory Admin Flaws

Common methods AD administrators use to protect their environments can easily be exploited. Here's how.

No matter how many tools you buy or how many alerts flood the SOC, your security strategy is only as strong as its administration. If attackers can bypass an admin, they can own the system.

Administrator security was the crux of Sean Metcalf's 2018 DEF CON talk, "Exploiting Active Directory Administrator Insecurities," during which the Trimarc cofounder and CTO outlined the strategies admins are adopting to protect their environments and the flaws in their approaches.

Metcalf dove into current methods businesses are using to administer Active Directory, inherent weaknesses, and what defenders should be watching for. Examples included using read-only domain controllers in ways the organization doesn't expect, exploiting access to agents installed on domain controllers and other privileged systems, and exploiting AD forests.

His idea was to provide insight for red teamers pentesting against organizations improving their defenses, as well as for blue teamers hoping to improve their Active Directory security.

Years ago, he explained, organizations had many admins and sometimes, user accounts doubled as domain admins. Every local administrator account had the same username and password, and some environments had nearly as many domain admins as they did users.

"Old school admin methods," as Metcalf put it, meant logging into a workstation as an admin with credentials stored in Local Security Authority Subsystem Service (LSASS), running standard Microsoft admin tools with credentials in LSASS, and using RDP to log into the domain controller or admin servers for management.

It was "a target-rich environment" with multiple paths to exploit, he said. Now, admins are using newer methods like multi-factor authentication (MFA) and password vaults to protect their credentials so threat actors can't gain access to their environments.

Sneaking Past MFA

There are a few ways for attackers to subvert MFA and gain Active Directory access, Metcalf explained.

"Yes, MFA is good," he said. "But there are situations in which MFA can be bypassed depending on how it's configured." If an attacker knows how to switch authentication data, for example, they can enter their own phone number and have second-factor codes directly sent to their device without the administrator's knowledge.

One of the interesting things about MFA is its onboarding process, he added, using a vendor's authentication technology as an example. The tech works by connecting to an API; when someone connects and sees a prompt, it checks to see if that user can access a specific resource.

However, he continued, if a third party could compromise the admin account, they could have influence over that email so they could filter it out and/or add more devices. Metcalf presented a screen showing different integration options during the configuration process. For example, he explained, an attacker could configure an admin's authentication so it could be bypassed while the user is offline, and/or uncheck the policy that requires authentication while logging in via RDP.

Metcalf recommended using MFA but advised attendees not to rely on it as the primary method for protecting admin accounts. Use hardware tokens or apps, he said, and disable SMS when possible. Ensure all MFA users know how to report anomalies when they see them.

"Remember that once an attacker has AD admin credentials, MFA doesn't really stop them," he noted. He advised correlating users to admin accounts and the workstation used by each admin, in order to make sure the proper person is in place ot be handling admin processes.

Password Vaults

Enterprise password vaults are another tool being deployed more broadly to improve admin security and maintain admin accounts, Metcalf continued. Many businesses include additional components like "Session Manager" to augment security in addition to the password vault.

He detailed several weaknesses in password vault configuration: authentication to the password vault's Web server is usually done with the admin's user account, and connecting to the server doesn't always require MFA. Password vault servers are often administered like any other server and usually permit anyone on the network to send traffic.

Sessions on the server aren't always limited, he continued, creating an opportunity for an attacker to create a new session. Combining the password vault Web server and password management system increases risk, and a flaw in the vault can lead to full AD compromise.

Metcalf pointed to vulnerability CVE-2018-9843 as an example. The flaw in the REST API of password vault software could potentially allow remote attackers to execute arbitrary code through a serialized .NET object in an Authorization HTTP header.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.