Hey there, ready to dive deep.
Today, we're going to tackle active directory security.
It's kind of like the VIP list for your company's network,
like who gets in, what they can access.
It's all controlled through active directory.
And you give us a ton of great material for this,
a whole handbook on active directory security,
exploitation, and mitigation techniques.
So we're going to walk through the most common attack techniques,
how to spot them, and of course, how to protect yourself.
That's right.
Active directory is powerful, no doubt,
but it's also a prime target for attackers.
It can be a complex topic, but we're going to try to break it
down in a way that makes sense no matter your tech level.
By the end of this deep dive, you'll understand why securing
your active directory is non-negotiable.
OK, so let's unpack this a little bit.
What exactly IS active directory?
And why should we be so worried about it?
So active directory, or AD, as it's often called,
it's like the brains of most organizations networks.
It manages users, computers, permissions, security policies,
really everything runs through AD.
So if someone gains control of AB, they essentially
control the whole network.
Exactly.
And that's what makes it so dangerous.
We're talking complete system take over data breaches,
ransomware attacks you name it.
OK, I'm starting to see why this is a big deal.
So let's say an attacker is targeting AD.
How would they even go about it?
Well, think of it like a classic high-st movie.
There are basically three main stages to an AD attack,
discovery, privilege, escalation, and lateral movement.
All right, walk me through those stages.
What happens in each one?
First, you have discovery.
This is where the attackers are gathering intel,
figuring out the layout of your network, right?
Identifying any valuable targets and spotting weaknesses
they can exploit.
So they're doing reconnaissance, casing the joint.
Precisely.
They're looking for user accounts, domain controllers,
vulnerable systems, anything that can give them a foothold.
OK, so they've scoped out the place.
What happens next?
Stage two is privilege escalation.
Now, they're trying to get their hands on some admin credentials,
essentially giving them the keys to the kingdom.
They might steal passwords, exploit vulnerabilities,
or even trick users into giving them access.
Sneaky.
So once they've got those admin privileges, what's stopping them?
Nothing, really.
That's where lateral movement comes in.
They can then use their newfound power to access
sensitive data spread malware, or take control of other systems.
It's like they have an all-access past
to your entire network.
This is sounding pretty scary.
And this whole process can actually take time, right?
It's not like they just break in and steal everything at once.
You're absolutely right.
Studies have shown that attackers can linger in a network
for months before they're detected,
slowly expanding their control,
and doing a lot of damage along the way.
That's why understanding their specific tactics is so important.
OK, so let's get into some of those tactics then.
What are some of the ways attackers can actually break
into active directory?
One very common technique involves what
they're called alternate authentication methods.
Essentially, it's a way to bypass normal login procedures.
Interesting. How does that work?
Well, two popular methods are past the hash,
PTH for short, and past the ticket, or PTT.
They both exploit weaknesses in how windows handles authentication.
So instead of trying to steal my password directly,
they're going after something else.
Exactly.
With PTH, they're targeting a specific protocol called
NTLM, which is used to verify your identity on the network.
OK, so what's wrong with NTLM?
The issue is that NTLM relies on a pre-computed hash
of your password.
It's kind of like a secret code that represents your password.
If an attacker can steal this hash,
they can actually impersonate you on the network
without ever knowing your actual password.
Wow, so they're basically creating a copy of my key,
and the system doesn't even know the difference.
That's the danger.
And there are a few ways they can get this hash.
They might infect your computer with malware,
snoop on network traffic, or even find it in system backups.
Tools like MIMICATPS are specifically designed to extract these hashes.
MIMICATPS sounds like something out of a spy movie.
It does, doesn't it?
Yeah.
But it's a very real threat.
Once they have your hash, they can use it to authenticate
to other systems and move laterally through the network.
It's a fast and effective way to escalate privileges.
OK, so PTH is all about exploiting NTLM.
What about past the ticket?
How does that one work?
PTT focuses on Caberos, another authentication protocol used by windows.
This time they're after something called a ticket granting ticket,
or TGT.
A TGT, what's so special about that?
Think of it as like a master key for your network.
Once you have a TGT, you can access many resources
without needing to enter your password every single time.
So if an attacker steals my TGT, they can just roam freely through my network.
You got it, and it gets even worse.
They can use that stolen TGT to request additional tickets for specific services,
giving them even more access.
It's like they're collecting keys to every room in your house.
Yikes, how did they even get their hands on these TGTs in the first place?
Tools like Mimicats, Kekio, and Rubius are their weapons of choice.
These tools are specifically designed to extract and manipulate Caberos tickets.
This is a lot to take in.
Is there any way to tell if these attacks are actually happening in my network right now?
Absolutely.
There are specific events in your system logs that can signal PTH or PTT activity.
Things like event IDs, 1, 5, 10, 4, 6, 24, and a few others.
If you see these events popping up especially in unusual patterns,
it could be a sign that something's wrong.
Okay, so we need to keep a close eye on those event logs.
But what about defenses?
How can we make it harder for attackers to pull off these PTH and PTT attacks in the first place?
One of the most effective measures is enabling Windows Defender Credential Guard.
It uses virtualization to protect those sensitive credential materials,
making it much harder for attackers to steal those hashes or tickets.
So lock down those credentials, make them fortenox level secure.
Exactly.
And on top of that, good old fashioned password hygiene is still crucial.
Randomizing those local admin passwords,
restricting who has admin privileges and limiting the number of devices with admin rights can
make a world of different.
Right, so it's not just about the technical solutions.
It's also about good security practices in general.
Absolutely.
And of course, staying informed about new threats and mitigation techniques is key.
The cybersecurity landscape is always evolving.
Always learning.
Always adapting.
All right, we've covered PTH and PTT.
What other sneaky active directory attacks do we need to know about?
Well, let's talk about curb roasting.
This one targets service accounts with SPNs that stands for service principal names.
Okay, you're going to have to break that down for me.
What are service accounts and SPNs?
Think of service accounts as special users on your network.
They're responsible for running specific applications or services.
They need their own set of credentials and that's where SPNs come in.
So SPNs are like IDs for these service accounts.
Exactly.
They help clients identify and connect to the right service on the network.
The problem is these STNs are often linked to passwords.
And Crabaros uses those passwords to encrypt certain tickets.
Oh, I'm sensing a vulnerability here.
You're right.
Attackers can request these encrypted tickets, often using tools like impact it in rubies.
And then they'll try to crack the encryption offline using bootforce methods.
So they're basically trying to crack the passwords associated with these service accounts.
What happens if they succeed?
If they managed to crack the encryption, will they gain control of that service,
which could give them access to sensitive data or even allow them to take control of critical systems?
This is sounding like a disaster waiting to happen.
How can we tell if a curb roasting attack is going on?
Keep an eye out for event IDs 4769 and 4770 in your logs.
These events record Crabaros service ticket requests and any unusual patterns can point to
curb roasting activity.
Another red flag for our log analysis checklist.
Got it.
So how do we protect ourselves from curb roasting?
First and foremost, make sure those service account passwords are strong and unique.
Think long complex and random.
Don't reuse passwords across different accounts.
It's a good password advice in general.
It is.
Another effective measure is to enable something called Crabaros Armoring or Fast.
It makes it much harder to crack that encryption used in those Crabaros tickets.
So it's like putting extra layers of armor around those passwords making them harder to break.
Exactly.
And if possible, try to move away from the RC4 encryption protocol in Crabaros.
It's known to be weak and vulnerable to attacks.
Okay, strong passwords.
Crabaros Armoring Ditch RC4.
Got it.
What other active directory attack techniques should we be aware of?
Let's talk about the infamous golden ticket attack.
This one's a real showstopper.
Golden ticket sounds almost desirable.
Not so much.
It's more like the ultimate skeleton key for your entire network.
Okay, now you've got my attention.
How does this golden ticket attack work?
It all hinges on a special account called the CARBTGD account.
Think of it as the Master Keyholder for your entire domain.
It has the power to encrypt and sign all the Crabaros tickets.
So if you control the CARBTGD account, you control the entire Crabaros system.
Bingo. And that's exactly what the golden ticket attack aims to do.
Attackers try to steal the CARBTG account's password hash.
It's incredibly powerful.
Hold on, this CARBTGD account sounds pretty important.
How do they even get access to it the first place?
It must be heavily guarded.
It is, but no system is perfect.
They might exploit vulnerabilities, use social engineering tricks,
or if they've already gained admin access, they can just dump the hash from the domain
controllers memory.
Okay, let's say they got the CARBTGD hash.
What do they do with it?
They use it to forge a special Crabaros ticket, and that's the golden ticket.
It grants them virtually unlimited access to the network for as long as they want.
Wait, as long as they want, that's terrifying.
It is. They can impersonate any user access, any resource, and basically do whatever they please.
And here's the kicker.
Because it's forged with the actual CARBTGD hash,
it looks completely legitimate to the system.
So it's like a magic key that never expires.
Precisely.
And it's incredibly difficult to detect.
Okay, I'm officially freaked out.
Are there any tools used for these golden ticket attacks?
Mimicats and impact it are the usual suspects.
Again, Mimicats can extract the CARBTGD hash and forge the ticket,
while impact it is used to inject the ticket and gain access.
Like, those tools seem to be popping up everywhere.
We definitely need to be on the lookout for them.
But more importantly, how can we prevent these golden ticket attacks from happening in the first place?
Regularly changing the CARYTGD account password is crucial.
And I mean, regularly every few months, even more often, if you can.
Treat that password like it's made of solid gold.
You got it.
And of course, make sure it's strong and unique.
No password reuse.
Strong passwords.
Regular changes.
Check and check.
Anything else?
Minimizing the number of accounts with elevated privileges is also key.
The fewer accounts that have access to sensitive data and systems,
the harder it is for attackers to get a hold of that CARBTGD hash in the first place.
So limit those VIP passes to the network.
Exactly.
And don't forget about restricting admin privileges across security boundaries.
If an attacker compromises a workstation,
they shouldn't be able to easily escalate their privileges to the domain controller.
Right, contain the damage.
This is a lot to absorb, but it's definitely eye-opening.
It's crucial information.
Active directory security is an ongoing process and understanding these attacks is the first step
towards preventing them.
Right, we've covered PTH, PTT,
curb roasting and golden ticket attacks.
There's a lot more ground to cover.
So let's dive into some more advanced techniques in the next part of this deep dive.
Ready to keep exploring the dark arts of Active Directory attacks?
Absolutely.
Hit me with your next mind-blowing technique.
Well, let's talk about BC Shadow.
This one's a bit like creating a phantom puppet master that can control your entire network.
Okay, that sounds both intriguing and terrifying.
Break it down for me.
What is DC Shadow and how does it work?
Imagine this. An attacker sets up a rogue server that pretends to be a legitimate domain controller.
This fake domain controller can then manipulate Active Directory and making changes that
ripple throughout the entire network.
So they're creating a counterfeit brain for the network.
Exactly.
And because these changes get replicated to other domain controllers, they become persistent.
Even if the attacker removes their rogue server, it's poisoning them.
Well, the damage is done even after they're gone.
This is some seriously advanced stuff.
Yeah.
How do they even pull off creating a fake domain controller?
It does require a bit of groundwork.
First, they need admin privileges, which, as we discussed, is often their primary objective.
Once they have that, they can use a tool like MIMICATS.
Yes, that versatile tool.
Again, to create and register their rogue domain controller.
MIMICATS really is the Swiss Army knife of Active Directory attacks.
So they set up this fake domain controller using MIMICATS.
Then what?
That's when the real fun begins.
They can start replicating changes from legitimate domain controllers to the rogue server.
They could add new users, grant themselves elevated permissions, even modify security policies
all under the radar.
So they're essentially rewriting the rules of the network without anyone knowing.
Precisely.
And because these changes are replicated, they become embedded in the system.
It's a stealthy and incredibly powerful attack.
Okay, I'm officially concerned.
How do we even detect this DC shadow attack?
If it's designed to blend in so seamlessly.
Good question.
This is where network monitoring becomes absolutely vital.
You need to be able to spot an usual DRS-UAPI or PC request, particularly something called
the DRS-UAPI or Bracad operation.
That's a big red flag that a DC shadow attack might be in progress.
So that's our smoking gun.
Anything else we should be looking out for?
Analyzing Windows event logs can also offer some clues, though it might not paint the full
picture.
Events, 5136 and 5141, which log changes to directory service objects could reveal
suspicious activity.
So network monitoring and event lag analysis are our detective tools in this case.
But how do we prevent DC shadow attacks from happening in the first place?
Like most Active Directory attacks, it boils down to tightly controlling admin privileges
and securing your network.
Make sure only a select few have the authority to add computer objects to Active Directory
control access to remote management protocols like RDP and keep your Active Directory environment
clean, removing unused sites and computer objects reduces the attack surface.
So keep a tidy keep it locked down.
Got it.
What other attack techniques should we be adding to our watch list?
Let's shift gears and talk about ASRP roasting.
This one prays on accounts that have Caberos preauthentication disabled.
Okay, remind me what Caberos preauthentication is again.
It's an extra layer of security that verifies a user's identity before issuing any tickets.
Think of it as a security checkpoint that helps prevent attackers from simply guessing
passwords.
So ASRP roasting targets accounts that don't have this extra security checkpoint.
Exactly.
Attackers send a special request to the domain controller and if preauthentication is disabled,
the server responds with a message containing the user's password hash.
Wait, it's the server just hands over the hash that doesn't sound very secure.
It's definitely a weakness and that's precisely what attackers exploit.
They can then try to crack that hash offline using tools like hash cap.
So it's a bit like a smashing grab for password hashes.
It's a good analogy and the scary part is that it can be done remotely and relatively quietly.
Okay, so what can we do to detect these ASRP roasting attacks?
Event ID 4708 should be on your radar.
This event logs user account changes and it can be a telltale sign of an attacker
manipulating domain objects for this attack.
Another red flag for our log analysis tool kit.
What about defenses?
How can we prevent ASRP roasting from happening?
The most effective solution is simple.
Enable Kubernetes preauthentication for all user accounts.
It's a straightforward change that makes a huge difference in security.
Enable preauthentication check.
Anything else we should be doing?
Of course, strong password policies are always a good idea.
Enforce long complex passwords that are difficult to crack and encourage users to use a password
manager to help them keep track of everything securely.
Strong passwords, it's the cybersecurity mantra.
All right, what's next on our Active Directory attack technique tour?
Let's dive into LDD injection attacks.
This one exploits the way Active Directory uses the LDAT protocol for communication.
Okay, backup for a second.
What exactly IS LDAPI and how does it fit into the Active Directory world?
Think of LDAP as the language that Active Directory speaks.
It's a protocol specifically designed for accessing and managing directory services and Active
Directory relies heavily on it for all sorts of communication.
So it's like the underlying communication system, what's the problem with that?
The problem arises when applications that interact with Active Directory don't properly
validate user input.
This can allow attackers to sneak malicious code into LDAC queries, essentially hijacking
the conversation.
So they're injecting bad commands into the system's communication channels.
Exactly.
And that can lead to all sorts of trouble by passing authentication, escalating privileges,
even stealing sensitive data.
Okay, this LDAPI injection thing sounds pretty dangerous.
Are there different ways attackers can exploit this vulnerability?
There are several types of LDAPI injection attacks.
One common technique is privilege escalation, where they inject code that tricks the server
into thinking they have higher privileges than they actually do.
So they're forging their credentials, essentially.
He got it.
Another common technique is access control bypass.
They craft a query that lets them completely bypass authentication, gaining access without
needing a valid password.
Sneaking in through the back door.
And what about data theft can that use LDAPI injection for that as well?
Absolutely.
They can inject code that retrieve sensitive information from the directory, effectively
turning LDAPI into a data exfiltration tool.
Okay, this LDAPI injection vulnerability sounds like a major headache.
How can we even spot it happening?
Unfortunately, it can be quite tricky to detect.
It often requires digging into application logs and looking for unusual patterns and LDAP queries.
It's detective work for sure.
So it's a bit like searching for a needle in a hay stack.
What about prevention?
How do we stop these LDAP injections from happening in the first place?
Input validation is absolutely crucial here.
Developers need to make sure their applications are thoroughly sanitizing and escaping
all user input before sending it to active directory.
It's like installing a filter that catches any malicious code before it reaches the system.
So clean up those queries before they even get a chance to cause trouble.
Precisely.
And pay close attention to escaping special characters in D.N.s.
English names and search filters.
Those are often used in LDate queries and attackers can manipulate them to slip in their malicious
code.
Okay, so input validation and proper escaping are our best defenses against LDAP injection.
Got it.
Are we ready for one more attack technique before we wrap things up?
You bet.
Let's talk about the Petypotem NTLM relay attack.
This one targets active directory certificate services or ADCS for short.
So certificate services, that sounds pretty official.
It is ADCS is responsible for managing and issuing digital certificates within an organization.
It's a crucial part of many security systems.
Okay, so what's the Petypotem attack all about?
It takes advantage of a combination of legacy NTLM authentication, remember that old friend.
And the MSESRPC protocol.
It uses these to trigger authentication requests and relay them to the ADCS server.
I'm starting to see a pattern here.
NTLM keeps cropping up as a vulnerability.
You're not wrong.
It's an older protocol with some inherent weaknesses.
And in this case, the attacker exploits the fact that ADCS often doesn't enforce extended
protection for authentication or EPA.
So it's another case of exploiting a lack of security measures.
Exactly.
The consequences can be pretty severe.
The attacker can essentially trick the ADCS server into issuing them a certificate for
a domain controller account.
Hold on, so they get a certificate that gives them control over a domain controller.
Is that like getting the keys to the kingdom?
It is.
And with that certificate, they can wreak havoc.
They can request a TGT perform a DC sync attack and essentially gain complete control over
the domain.
This is getting pretty intense.
How can we even begin to detect this type of attack?
Network monitoring once again is incredibly important.
You need to be on the lookout for any NTLM relay traffic, especially any that's headed
towards your ADCS servers.
Okay, network monitoring is definitely a must-have.
What about prevention?
How do we stop Petypotem and its tracks?
The abling EPA for your ADCS servers is the most crucial step.
It throws a wrench in the attacker's plans, making it much harder to relay authentication
requests.
Enable EPA check.
Anything else we can do to bolster our defenses?
For extra security, consider enabling SSL only connections for your ADCS web services.
This forces all communication to be encrypted, making it much tougher for attackers
to intercept and manipulate traffic.
It's like adding an extra layer of protection around your communication channels.
Okay, so Petypotem is all about abusing NTLM and ADCS misconfiguration.
We've covered a lot of ground today.
What are some key takeaways you want our listeners to remember as we wrap up this
part of the deep dive?
Active directory, it's really like the nervous system of your organization and unfortunately
attackers know just how important it is.
They're constantly devising new ways to exploit weaknesses and seize control.
Yeah, it sounds like a constant game of cat and mouse.
But surely there are things we can do to protect ourselves, right?
Absolutely.
He is to be proactive.
Don't wait for an attack to happen.
Start building up your defenses now.
Okay, so where do we even begin?
There's so much to consider when it comes to active directory security.
Think of it as building a fortress layer by layer.
You start with the foundations, strong passwords, limiting admin privileges, conducting regular
security audits.
Right, the cybersecurity essentials, the basics that everyone should be doing.
Exactly.
Once you have those in place, you can start adding more advanced layers of protection.
It's like enabling Windows Defender credential guard, implementing Kubernetes armoring,
and ensuring proper input validation for any applications that talk to active directory.
So it's about creating multiple lines of defense, making it as difficult as possible for
attackers to actually breach our systems.
That's the idea.
And don't underestimate the power of network monitoring and event log analysis.
Think of them as your surveillance system constantly watching for any suspicious activity.
The sooner you can spot a potential attack, the better your chances of stopping it before
it causes real damage.
Right, early detection is key.
It's much easier to put out a small fire than a raging inferno.
We've covered a lot of ground today from basic concepts to some seriously advanced attack
techniques.
Is there anything else our listeners should keep in mind as they navigate the world of active
directory security?
The cybersecurity landscape is constantly evolving.
New threats emerge all the time, so staying informed and up to date is crucial.
So where can our listeners go to keep learning and stay ahead of the curve?
Microsoft's security blogs and documentation are a great place to start.
The MITRE 18CK framework is another fantastic resource for understanding the tactics and
techniques used by attackers.
And of course, keep listening to podcasts like this one.
We're always here to break down complex security topics and help you stay informed.
Putting the set at better myself.
Now here's a final thought for our listeners to ponder.
We focused on technical attacks today, but let's not forget that human error can often
be the weakest link in any security system.
Fishing scams, weak passwords, clicking on suspicious links.
These are all things that can compromise even the most secure active directory environment.
That's an important point.
Security awareness training for all users is absolutely essential.
Absolutely.
Technology can only take you so far.
Ultimately it's up to each individual to be vigilant and follow good security practices.
To stay informed, stay vigilant and stay safe out there until next time.
That's all, see we'll see you in the next video.