Finding Our Path

How We’re Trying to Improve Active Directory Security

Andy Robbins

@_wald0

Rohan Vazarkar

@CptJesus

Will Schroeder

@harmj0y

2

Background

Prior Work and Acknowledgements

Alice Zheng, John Dunagan, Daniel Simon:

http://alicezheng.org/papers/sosp2009-heatray-10pt.pdf�

Emmanuel Gras and Lucas Bouillot:

https://github.com/ANSSI-FR/AD-control-paths�

Sean Metcalf:

https://www.adsecurity.org

4

What is BloodHound?

• A way to apply graph theory to Active Directory
• A way to simplify Active Directory privilege analysis
• A way to visualize Active Directory relationships
• Google Maps for Active Directory

​

5

What problem did BloodHound solve?

• How do you go from one place in Active Directory to another?
• How do you escalate your privileges without scanning the network many, many times?
• How do you analyze permissions more efficiently than built-in tools?

​

6

7

8

Allows enumeration of remote server sessions as an unprivileged user!

9

Allows enumeration of local group members on remote servers as an unprivileged user!

Story Time!

• A pentester named Nat Melson gets initial access in cornhub.io
• Wants to get Domain Admin... how do they do it?
• Let’s look at the small Indiana office

10

1

1

1

1

1

1

1

1

1

1

1

2

2

1

1

1

1

1

1

1

2

2

1

1

1

1

1

1

1

2

2

1

1

1

1

1

2

2

3

3

2

2

2

2

2

2

2

3

3

2

2

3

3

2

2

2

3

3

2

2

3

3

2

2

2

3

3

2

2

3

3

2

Story Time!

• This process is SLOW
• More and more network hits as you keep going, more and more chances to get caught
• Keeping track of things gets exponentially more difficult as environment size increases!
• An entire branch of math exists to solve this exact problem...so why are we doing it by hand?

20

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

But wait...there’s more!

• Running SharpHound, doesn’t just get you this info, you get so much more!
• Kerberos (mis)configurations
• Security group memberships
• Abusable ACEs
• Potential MSSQL Abuse

​

25

In the real world

• BloodHound was created due to a massive organization with hundreds of thousands of endpoints
• Manual analysis took weeks for a single domain.
• The organization had hundreds of domains.
• This did not spark joy 👎
• BloodHound showed us a path that jumped through 7 different domains, and resulted in a compromise of the forest root.

26

Example Attack Path

Resource-based Constrained Delegation

Motivation: A modern (server 2012+) way to “safely” allow user impersonation in Active Directory

​

28

29

Auth to

Frontend Service

“Pretend”

to be

User

Frontend

Backend

User

Resource-based Constrained Delegation: Background

• Implemented with a security descriptor (DACL) on a target resource/computer object
• The DACL is stored as a series of binary bytes in the msDS-AllowedToActOnBehalfOfOtherIdentity
• Defines who is allowed to impersonate (any) users to the target system
• Impersonation is performed with the S4U2self/S4U2proxy Kerberos extensions

30

Resource-based Constrained Delegation: Background

• In Spring 2019, Elad Shamir released his “Wagging the Dog” post on RBCD abuse
• His big finding:
• Non-forwardable S4U2self tickets still work for S4U2proxy when performing resource-based constrained delegation
• Translation: this grants us a generalized ACL-based computer takeover attack primitive!

31

Resource-based Constrained Delegation: In English

If we can modify the msDS-AllowedToActOnBehalfOfOtherIdentity property of a computer object in Active Directory, we can compromise the computer itself in modern domains!

32

(Videos 1-4)

​

The Adversary Resilience Methodology

Attackers think in graphs, defenders think in lists.

As long as this is true, attackers win.

​

John Lambert

Distinguished Engineer, Microsoft

35

https://blogs.technet.microsoft.com/johnla/2015/04/26/defenders-think-in-lists-attackers-think-in-graphs-as-long-as-this-is-true-attackers-win/

“

Adversary Resilience Methodology

https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-one-e38e06ffd604

Adversary Resilience Methodology

https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-one-e38e06ffd604

Quantify Privileges, Understand Attack Paths

Objective: find critical low hanging fruit, generate descriptive statistics, measure overall security posture

38

Most Privileged Groups

39

Computers with Most Admins

40

(Video 5)

Privileged Kerberoastable Users

42

Privileged Kerberoastable Users With Weak Passwords

43

Percentage of Users with a Path to Domain Admin

44

Adversary Resilience Methodology

https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-one-e38e06ffd604

Adversary Resilience Methodology

https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-one-e38e06ffd604

Generate and Validate Remediation Hypotheses

Objective: eliminate or mitigate as many attack paths as possible using practical and measurably effective strategies

47

48

49

50

51

52

53

54

55

56

57

58

59

60

• Finding “All Paths” means finding the longest path

​

• In graph theory, the longest path problem is NP-hard for directed, cyclic graphs

20,346,385

62

Shortest Attack Paths

Active Directory is not a maze.

63

Active Directory is not a maze.

64

Active Directory is a map.

65

66

67

68

69

70

71

72

73

74

75

Forget about analyzing all paths.

​

Focus on isolating sensitive principals.

Domain Admin Exposure

• Credentials in memory
• Abusable ACEs
• GPO Abuse
• Kerberoast
• AS-REP Roast

77

Domain Admin Exposure

• Credentials in memory
• Abusable ACEs
• GPO Abuse .
• Kerberoast
• AS-REP Roast

78

79

80

81

Percentage of Users with a Path to Domain Admin

​

Before

After

82

Domain Admin Exposure

• Credentials in memory
• Abusable ACEs
• GPO Abuse .
• Kerberoast
• AS-REP Roast

83

Domain Admin Exposure

• Credentials in memory
• Abusable ACEs .
• GPO Abuse .
• Kerberoast
• AS-REP Roast

84

Percentage of Users with a Path to Domain Admin

​

Before

After

88

Percentage of Users with a Path to Domain Admin

​

Before

After

89

Everything In This Talk is Free and Open Source

Tools: Methodology:�BloodHound: Resilience Methodology:� https://bit.ly/GetBloodHound https://bit.ly/2YI2g5B �BloodHound Analytics:� https://github.com/BloodHoundAD/BloodHound-Tools �PowerView:� https://bit.ly/1pzQCnv �PowerMad: � https://github.com/Kevin-Robertson/Powermad/blob/master/Powermad.ps1 �Invoke-DCSync:� https://gist.github.com/monoxgas/9d238accd969550136db

90

Andy Robbins

@_wald0

Rohan Vazarkar

@CptJesus

Will Schroeder

@harmj0y

@SpecterOps specterops.io

Thank you!

91

CREDITS

Special thanks to all the people who made and released these awesome resources for free:

• Presentation template by SlidesCarnival
• Maps from David Rumsey Map Collection

92