Vulnerabilities / Threats

8/17/2018
01:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Exploring, Exploiting Active Directory Admin Flaws

Common methods AD administrators use to protect their environments can easily be exploited. Here's how.

No matter how many tools you buy or how many alerts flood the SOC, your security strategy is only as strong as its administration. If attackers can bypass an admin, they can own the system.

Administrator security was the crux of Sean Metcalf's 2018 DEF CON talk, "Exploiting Active Directory Administrator Insecurities," during which the Trimarc cofounder and CTO outlined the strategies admins are adopting to protect their environments and the flaws in their approaches.

Metcalf dove into current methods businesses are using to administer Active Directory, inherent weaknesses, and what defenders should be watching for. Examples included using read-only domain controllers in ways the organization doesn't expect, exploiting access to agents installed on domain controllers and other privileged systems, and exploiting AD forests.

His idea was to provide insight for red teamers pentesting against organizations improving their defenses, as well as for blue teamers hoping to improve their Active Directory security.

Years ago, he explained, organizations had many admins and sometimes, user accounts doubled as domain admins. Every local administrator account had the same username and password, and some environments had nearly as many domain admins as they did users.

"Old school admin methods," as Metcalf put it, meant logging into a workstation as an admin with credentials stored in Local Security Authority Subsystem Service (LSASS), running standard Microsoft admin tools with credentials in LSASS, and using RDP to log into the domain controller or admin servers for management.

It was "a target-rich environment" with multiple paths to exploit, he said. Now, admins are using newer methods like multi-factor authentication (MFA) and password vaults to protect their credentials so threat actors can't gain access to their environments.

Sneaking Past MFA

There are a few ways for attackers to subvert MFA and gain Active Directory access, Metcalf explained.

"Yes, MFA is good," he said. "But there are situations in which MFA can be bypassed depending on how it's configured." If an attacker knows how to switch authentication data, for example, they can enter their own phone number and have second-factor codes directly sent to their device without the administrator's knowledge.

One of the interesting things about MFA is its onboarding process, he added, using a vendor's authentication technology as an example. The tech works by connecting to an API; when someone connects and sees a prompt, it checks to see if that user can access a specific resource.

However, he continued, if a third party could compromise the admin account, they could have influence over that email so they could filter it out and/or add more devices. Metcalf presented a screen showing different integration options during the configuration process. For example, he explained, an attacker could configure an admin's authentication so it could be bypassed while the user is offline, and/or uncheck the policy that requires authentication while logging in via RDP.

Metcalf recommended using MFA but advised attendees not to rely on it as the primary method for protecting admin accounts. Use hardware tokens or apps, he said, and disable SMS when possible. Ensure all MFA users know how to report anomalies when they see them.

"Remember that once an attacker has AD admin credentials, MFA doesn't really stop them," he noted. He advised correlating users to admin accounts and the workstation used by each admin, in order to make sure the proper person is in place ot be handling admin processes.

Password Vaults

Enterprise password vaults are another tool being deployed more broadly to improve admin security and maintain admin accounts, Metcalf continued. Many businesses include additional components like "Session Manager" to augment security in addition to the password vault.

He detailed several weaknesses in password vault configuration: authentication to the password vault's Web server is usually done with the admin's user account, and connecting to the server doesn't always require MFA. Password vault servers are often administered like any other server and usually permit anyone on the network to send traffic.

Sessions on the server aren't always limited, he continued, creating an opportunity for an attacker to create a new session. Combining the password vault Web server and password management system increases risk, and a flaw in the vault can lead to full AD compromise.

Metcalf pointed to vulnerability CVE-2018-9843 as an example. The flaw in the REST API of password vault software could potentially allow remote attackers to execute arbitrary code through a serialized .NET object in an Authorization HTTP header.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft, Mastercard Aim to Change Identity Management
Kelly Sheridan, Staff Editor, Dark Reading,  12/3/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19653
PUBLISHED: 2018-12-09
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.
CVE-2018-19982
PUBLISHED: 2018-12-09
An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP > Server > Controller (HUB) > Node (products which are controlled by HUB). The prerequisite is that the attacker is on the same network as the target HU...
CVE-2018-19983
PUBLISHED: 2018-12-09
An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., Z-Wave PC Controller, OpenZWave, CC1110, etc.). Next, the attacker conducts a DoS attack against the Z-Wave S0 Security version product by continuously sending ...
CVE-2018-19980
PUBLISHED: 2018-12-08
Anker Nebula Capsule Pro NBUI_M1_V2.1.9 devices allow attackers to cause a denial of service (reboot of the underlying Android 7.1.2 operating system) via a crafted application that sends data to WifiService.
CVE-2018-19961
PUBLISHED: 2018-12-08
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.