WEBVTT

00:00:00.000 --> 00:00:02.950 align:middle line:90%


00:00:02.950 --> 00:00:03.700 align:middle line:90%
Hi.

00:00:03.700 --> 00:00:06.490 align:middle line:84%
In this group of
video lessons, we

00:00:06.490 --> 00:00:09.550 align:middle line:84%
will go through the most
common Active Directory attacks

00:00:09.550 --> 00:00:13.420 align:middle line:84%
that adversary are using to
compromise our environments.

00:00:13.420 --> 00:00:16.239 align:middle line:84%
These attacks are often
used in escalation

00:00:16.239 --> 00:00:19.930 align:middle line:84%
in the environment where they
can obtain higher privileges.

00:00:19.930 --> 00:00:22.900 align:middle line:84%
And unfortunately,
often that leads

00:00:22.900 --> 00:00:25.150 align:middle line:84%
to gaining access
to the main admin

00:00:25.150 --> 00:00:27.610 align:middle line:90%
account or similar privileges.

00:00:27.610 --> 00:00:29.680 align:middle line:84%
We will are also
looking to common tools

00:00:29.680 --> 00:00:33.010 align:middle line:84%
that you can use to analyze
your Active Directory that

00:00:33.010 --> 00:00:36.820 align:middle line:84%
can identify potential issues
or misconfigurations that

00:00:36.820 --> 00:00:39.340 align:middle line:90%
can allow for such escalation.

00:00:39.340 --> 00:00:42.220 align:middle line:84%
We will begin by looking
at some of the attacks.

00:00:42.220 --> 00:00:49.330 align:middle line:84%
And I just want to mention that
the purpose of these videos

00:00:49.330 --> 00:00:51.850 align:middle line:84%
is not to really
demonstrate the attacks

00:00:51.850 --> 00:00:55.450 align:middle line:84%
and how they are happening,
but rather understand

00:00:55.450 --> 00:00:58.270 align:middle line:84%
what the attacks are,
why are they possible,

00:00:58.270 --> 00:01:00.580 align:middle line:84%
and then discuss
different preventions

00:01:00.580 --> 00:01:03.490 align:middle line:84%
that we can implement in
order to either mitigate

00:01:03.490 --> 00:01:06.370 align:middle line:84%
the risk of these attacks
or at least reduce

00:01:06.370 --> 00:01:09.990 align:middle line:84%
the risk of them being
successful in our environment.

00:01:09.990 --> 00:01:14.230 align:middle line:84%
We will begin by discussing an
attack called Kerberoasting,

00:01:14.230 --> 00:01:17.920 align:middle line:84%
and then we will move into
a similar attack called

00:01:17.920 --> 00:01:19.420 align:middle line:90%
ASREPRoast.

00:01:19.420 --> 00:01:21.970 align:middle line:90%
Both attacks are related--

00:01:21.970 --> 00:01:24.640 align:middle line:84%
Or both attacks
can be successful

00:01:24.640 --> 00:01:28.150 align:middle line:84%
if accounts have
weak passwords set.

00:01:28.150 --> 00:01:31.850 align:middle line:84%
We'll discuss them in depth when
we go into that specific video

00:01:31.850 --> 00:01:32.950 align:middle line:90%
module.

00:01:32.950 --> 00:01:34.420 align:middle line:84%
The next topic that
we will discuss

00:01:34.420 --> 00:01:38.620 align:middle line:84%
is that often many
administrators

00:01:38.620 --> 00:01:41.380 align:middle line:84%
tend to leave plaintext
passwords that

00:01:41.380 --> 00:01:43.810 align:middle line:84%
could be either in scripts
or in Active Directory

00:01:43.810 --> 00:01:46.870 align:middle line:84%
attributes, such as the
descriptions of users

00:01:46.870 --> 00:01:48.620 align:middle line:90%
or groups, and so on.

00:01:48.620 --> 00:01:49.610 align:middle line:90%
We will look into that.

00:01:49.610 --> 00:01:52.300 align:middle line:84%
And I have to tell
you, this is one

00:01:52.300 --> 00:01:55.900 align:middle line:84%
of the most common escalation
paths you will identify.

00:01:55.900 --> 00:02:01.480 align:middle line:84%
And a common reason for that is
because often, in environments,

00:02:01.480 --> 00:02:04.840 align:middle line:84%
one person would create a script
and put a password into it.

00:02:04.840 --> 00:02:06.550 align:middle line:84%
And then another
person will end up

00:02:06.550 --> 00:02:09.355 align:middle line:84%
sharing the folder without
really understanding that there

00:02:09.355 --> 00:02:11.200 align:middle line:90%
is sensitive information in it.

00:02:11.200 --> 00:02:14.710 align:middle line:84%
And in many cases, since
the organizations are big,

00:02:14.710 --> 00:02:18.100 align:middle line:84%
there is no good
one central overview

00:02:18.100 --> 00:02:22.040 align:middle line:84%
to identify all of those
shares being exposed.

00:02:22.040 --> 00:02:24.140 align:middle line:84%
We will then look
into potential issues

00:02:24.140 --> 00:02:27.950 align:middle line:84%
with abusing local accounts,
such as local administrator

00:02:27.950 --> 00:02:32.300 align:middle line:84%
account that exists by default
on our enterprise workstations.

00:02:32.300 --> 00:02:34.350 align:middle line:84%
Because if we have
the same password set

00:02:34.350 --> 00:02:37.550 align:middle line:84%
across multiple devices,
one compromised device

00:02:37.550 --> 00:02:41.270 align:middle line:84%
will gain or will provide enough
information to an attacker

00:02:41.270 --> 00:02:44.360 align:middle line:84%
to be able to laterally
move between all our devices

00:02:44.360 --> 00:02:47.180 align:middle line:84%
that have the same account
with the same password

00:02:47.180 --> 00:02:49.640 align:middle line:90%
to exist in them.

00:02:49.640 --> 00:02:52.220 align:middle line:84%
We will then move into
discussing the issues

00:02:52.220 --> 00:02:55.082 align:middle line:84%
with Kerberos delegation,
and why that is something

00:02:55.082 --> 00:02:56.540 align:middle line:84%
we need to know in
our environment.

00:02:56.540 --> 00:02:59.270 align:middle line:84%
As you will find out soon,
it's something that we really

00:02:59.270 --> 00:03:00.720 align:middle line:90%
also want to avoid.

00:03:00.720 --> 00:03:05.010 align:middle line:84%
So if possible, we try to
avoid it to the very minimum.

00:03:05.010 --> 00:03:08.040 align:middle line:84%
Then we will look into
Group Policy Preferences.

00:03:08.040 --> 00:03:10.950 align:middle line:84%
And especially, a bug
which was introduced

00:03:10.950 --> 00:03:15.030 align:middle line:84%
because the encryption keys that
were used to encrypt passwords

00:03:15.030 --> 00:03:20.640 align:middle line:84%
placed in GPO objects were
essentially mistakenly leaked

00:03:20.640 --> 00:03:22.266 align:middle line:90%
on our Microsoft docs.

00:03:22.266 --> 00:03:27.030 align:middle line:84%
And by doing so, all
passwords stored in GPOs

00:03:27.030 --> 00:03:29.700 align:middle line:84%
were essentially
available to attackers,

00:03:29.700 --> 00:03:30.850 align:middle line:90%
basically out of the box.

00:03:30.850 --> 00:03:32.360 align:middle line:84%
Since we had the
encryption keys,

00:03:32.360 --> 00:03:34.020 align:middle line:84%
from an attacker
point of view, we

00:03:34.020 --> 00:03:38.100 align:middle line:84%
could go get the encrypted
doc, decrypt it, and get

00:03:38.100 --> 00:03:39.690 align:middle line:90%
the passwords in plaintext.

00:03:39.690 --> 00:03:41.850 align:middle line:90%
And this happened 2014.

00:03:41.850 --> 00:03:45.870 align:middle line:84%
Microsoft has implemented
patches ever since,

00:03:45.870 --> 00:03:48.480 align:middle line:84%
but there was no way
to remove credentials

00:03:48.480 --> 00:03:49.750 align:middle line:90%
that already existed.

00:03:49.750 --> 00:03:52.200 align:middle line:84%
So if you have
any old GPOs, this

00:03:52.200 --> 00:03:54.690 align:middle line:84%
is what we'll be looking at,
identifying them and removing

00:03:54.690 --> 00:03:57.680 align:middle line:84%
credentials, if
they contain any.

00:03:57.680 --> 00:04:00.680 align:middle line:84%
We will also look into
an attack called DCSync.

00:04:00.680 --> 00:04:04.550 align:middle line:84%
And the core principle
behind this attack

00:04:04.550 --> 00:04:07.850 align:middle line:84%
is that a user with
sufficient permissions

00:04:07.850 --> 00:04:10.490 align:middle line:84%
can perform the maintenance
of our application,

00:04:10.490 --> 00:04:13.740 align:middle line:84%
and essentially obtain Active
Directory sensitive data,

00:04:13.740 --> 00:04:14.840 align:middle line:90%
such as password hashes.

00:04:14.840 --> 00:04:17.360 align:middle line:90%


00:04:17.360 --> 00:04:20.279 align:middle line:84%
We will afterwards start
looking at some of the tools.

00:04:20.279 --> 00:04:24.020 align:middle line:84%
The first one is a tool called
BloodHound, which is probably

00:04:24.020 --> 00:04:27.170 align:middle line:84%
the most popular tool
in direct teaming world

00:04:27.170 --> 00:04:30.860 align:middle line:84%
when it comes to penetration
testing Active Directory.

00:04:30.860 --> 00:04:33.680 align:middle line:84%
BloodHound will map your
entire Active Directory.

00:04:33.680 --> 00:04:37.430 align:middle line:84%
All its users, groups,
all the permissions

00:04:37.430 --> 00:04:41.240 align:middle line:84%
that they have over objects
or membership of groups.

00:04:41.240 --> 00:04:43.910 align:middle line:84%
Everything that is nested
in the entire tree,

00:04:43.910 --> 00:04:47.720 align:middle line:84%
you will be able to visualize
it in a very nice diagram.

00:04:47.720 --> 00:04:50.150 align:middle line:84%
And to discuss
BloodHound in depth,

00:04:50.150 --> 00:04:52.820 align:middle line:84%
we will perform a
demonstration and you'll

00:04:52.820 --> 00:04:55.440 align:middle line:90%
get more familiar with it.

00:04:55.440 --> 00:04:58.650 align:middle line:84%
We will then look at
another tool called

00:04:58.650 --> 00:05:01.590 align:middle line:84%
PingCastle, which is also
one of my favorites, that

00:05:01.590 --> 00:05:05.430 align:middle line:84%
can perform hundreds
of different checks

00:05:05.430 --> 00:05:08.820 align:middle line:84%
in your environment, and provide
information on whether it finds

00:05:08.820 --> 00:05:13.470 align:middle line:84%
something to be weird,
misconfigured, or just

00:05:13.470 --> 00:05:16.540 align:middle line:84%
recommends that it's being
done in a different way.

00:05:16.540 --> 00:05:21.480 align:middle line:84%
A common misconfiguration,
which I discover at customers,

00:05:21.480 --> 00:05:26.220 align:middle line:84%
is that certain GPOs can
be modified by all users.

00:05:26.220 --> 00:05:29.340 align:middle line:84%
And of course, that is
quite critical, especially

00:05:29.340 --> 00:05:33.420 align:middle line:84%
if these GPOs are
linked to computers,

00:05:33.420 --> 00:05:39.060 align:middle line:84%
such as domain controllers or
computers for domain admins

00:05:39.060 --> 00:05:41.640 align:middle line:90%
to login to.

00:05:41.640 --> 00:05:45.300 align:middle line:84%
Finally, we will look at a
tool called New-ADReport, which

00:05:45.300 --> 00:05:47.670 align:middle line:84%
is a PowerShell
script which will

00:05:47.670 --> 00:05:50.100 align:middle line:84%
extract the information
about all users

00:05:50.100 --> 00:05:52.680 align:middle line:84%
and all computers
in our directory

00:05:52.680 --> 00:05:54.600 align:middle line:90%
and save it to a CSV file.

00:05:54.600 --> 00:05:58.080 align:middle line:84%
That is really nice to have
because, in a CSV file,

00:05:58.080 --> 00:06:00.960 align:middle line:84%
we can manipulate the data, we
can filter out, we can remove.

00:06:00.960 --> 00:06:04.260 align:middle line:84%
And just having the overview in
there, as you will later see,

00:06:04.260 --> 00:06:07.280 align:middle line:84%
can be really beneficial
for us in the future.

00:06:07.280 --> 00:06:08.058 align:middle line:90%