Tags: Active Directory, PowerShell, Security
Video: Offline Attacks on Active Directory
September 19, 2019 | Michael Grafnetter | No Comments on Video: Offline Attacks on Active DirectoryHipConf 2018 Slide Deck
November 6, 2018 | Michael Grafnetter | No Comments on HipConf 2018 Slide DeckMy HipConf 2018 slide deck about Offline Attacks on Active Directory is available for download.
The Restore From Media stuff will be published in the upcoming DSInternals 3.1 release.
Impersonating Office 365 Users With Mimikatz
January 15, 2017 | Michael Grafnetter | 1 Comment on Impersonating Office 365 Users With MimikatzIntroduction
Last month, Microsoft has introduced a new feature of Azure AD Connect called Single Sign On. It allows companies to configure SSO between AD and AAD without the need to deploy ADFS, which makes it an ideal solution for SMEs. Here is a high-level diagram of this functionality:
As we can see from the diagram above, Azure AD exposes a publicly available endpoint that accepts Kerberos tickets and translates them into SAML and JWT tokens, which are understood and trusted by other cloud services like Office 365, Azure or Salesforce. And wherever you have Kerberos-based authentication, it can be attacked using Silver Tickets.
In usual circumstances this attack can only be performed from the intranet. But what really caught my attention is the fact that with this new SSO feature, Silver Tickets could be used from the entire internet. Let’s give it a try then!
The Nasty Stuff
To test this technique, we need to retrieve some information from Active Directory first:
- NTLM password hash of the AZUREADSSOACC account, e.g. f9969e088b2c13d93833d0ce436c76dd. This value can be retrieved from AD using mimikatz:
1mimikatz.exe "lsadump::dcsync /user:AZUREADSSOACC$" exit
My own DSInternals PowerShell Module could do the same job:
12Get-ADReplAccount -SamAccountName 'AZUREADSSOACC$' -Domain contoso `-Server lon-dc1.contoso.local
Both of these commands need Domain Admins permissions. - Name of the AD domain, e.g. contoso.local.
- AAD logon name of the user we want to impersonate, e.g. elrond@contoso.com. This is typically either his userPrincipalName or mail attribute from the on-prem AD.
- SID of the user we want to impersonate, e.g. S-1-5-21-2121516926-2695913149-3163778339-1234.
Having this information we can now create and use the Silver Ticket on any Windows computer connected to the internet. It does not even matter whether it is joined to a domain or a workgroup:
- Create the Silver Ticket and inject it into Kerberos cache:
1234mimikatz.exe "kerberos::golden /user:elrond/sid:S-1-5-21-2121516926-2695913149-3163778339 /id:1234/domain:contoso.local /rc4:f9969e088b2c13d93833d0ce436c76dd/target:aadg.windows.net.nsatc.net /service:HTTP /ptt" exit - Launch Mozilla Firefox.
- Go to about:config and set the network.negotiate-auth.trusted-uris preference to value “https://aadg.windows.net.nsatc.net,https://autologon.microsoftazuread-sso.com”.
- Navigate to any web application that is integrated with our AAD domain. We will use Office 365, which is the most commonly used one.
- Once at the logon screen, fill in the user name, while leaving the password field empty. Then press TAB or ENTER.
- That’s it, we’re in!
- To log in as another user, run the command below and repeat steps 1-6.
1klist purge
It is also worth noting that the password of the AZUREADSSOACC account never changes, so the stolen hash/key will work forever. It could therefore be misused by highly privileged employees to retain access to the IT environment after leaving the company. Dealing with such situations is a much broader problem, which is aptly depicted by the following old Narnian saying:
Countermeasures
First of all, I have to point out that this technique would not be very practical in real-world situations due to these reasons:
- The SSO feature is in Preview and has to be explicitly enabled by an AD admin. Just a handful of companies probably use it at the time of writing this article and enterprises will quite surely stick to their proven ADFS deployments even after this feature reaches GA.
- The hash/key of the AZUREADSSOACC account can only be retrieved by Domain Admins from DCs by default. But if an attacker had such highly privileged access to an Active Directory domain, he/she would be able to do some way nastier stuff than just replicating a single hash.
- The password of the AZUREADSSOACC account is randomly generated during the deployment of Azure AD Connect. It would therefore be impossible to guess this password.
As you can see, there is simply no need to panic. But just to be safe, I would recommend these generic security measures:
- Only delegate administrative access to trusted individuals and keep the number of members of the Domain Admins group (and other privileged groups) as low as possible.
- Protect backups of Domain Controllers, so no-one could extract sensitive information from them.
- Enable and enforce Azure MFA for users authenticating from external IP addresses. It is very straightforward and effective against many kinds of attacks.
- Consider implementing Azure AD conditional access.
- Deploy Microsoft Advanced Threat Analytics to detect malicious replication and other threats to your AD infrastructure.
- Force a password change on the AZUREADSSOACC account by
re-deploying Azure AD Connect SSOrunning the Update-AzureSSOForest cmdlet after a highly privileged employee leaves the company and/or on a regular basis. This should be done together with resetting the password of krbtgt and other sensitive accounts.
Conclusion
Although the Silver Ticket attack has been here for some years, it is now probably the first time it can be used over the internet against a cloud service, which theoretically makes it even more potent. On the other hand, it would be quite hard to perform this technique in a real-world environment due to impracticalities discussed in the previous section, so there is no need to worry. The new Seamless SSO feature of Azure AD Connect can therefore be considered safe and preferred solution for SSO to Office 365 .
Tags: Active Directory, Microsoft Azure, Mimikatz, Office 365, Security
Finding Weak Active Directory Passwords
January 11, 2017 | Michael Grafnetter | 3 Comments on Finding Weak Active Directory PasswordsI recently worked with Thycotic to create a program called Weak Password Finder for Active Directory. The goal was to develop a tool that would be very easy to use yet powerful enough to yield actionable results. I think that this combination really makes it unique in the market. It basically does the same as my PowerShell module, but with a nice and shiny user interface:
It generates reports which are suitable for the management:
Of course, you can also drill down through the detailed data:
Here is a quick demo of the tool:
Did I mention that the Weak Password Finder is totally FREE?
Auditing Active Directory Password Quality
August 7, 2016 | Michael Grafnetter | 19 Comments on Auditing Active Directory Password QualityOverview
The latest version of the DSInternals PowerShell Module contains a new cmdlet called Test-PasswordQuality, which is a powerful yet easy to use tool for Active Directory password auditing. It can detect weak, duplicate, default, non-expiring or empty passwords and find accounts that are violating security best practices. All domain administrators can now audit Active Directory passwords on a regular basis, without any special knowledge.
Usage
The Test-PasswordQuality cmdlet accepts output of the Get-ADDBAccount and Get-ADReplAccount cmdlets, so both offline (ntds.dit) and online (DCSync) analysis can be done:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 |
Get-ADReplAccount -All -Server LON-DC1 -NamingContext "dc=adatum,dc=com" | Test-PasswordQuality -WeakPasswordHashesFile .\pwned-passwords-ntlm-ordered-by-count.txt -IncludeDisabledAccounts <# Sample output: Active Directory Password Quality Report ---------------------------------------- Passwords of these accounts are stored using reversible encryption: April Brad Don LM hashes of passwords of these accounts are present: These accounts have no password set: Guest nolan test Passwords of these accounts have been found in the dictionary: adam peter Historical passwords of these accounts have been found in the dictionary: april brad These groups of accounts have the same passwords: Group 1: Aidan John Group 2: Joe JoeAdmin JoeVPN These computer accounts have default passwords: LON-CL2$ Kerberos AES keys are missing from these accounts: Julian Kerberos pre-authentication is not required for these accounts: Holly Chad Only DES encryption is allowed to be used with these accounts: Holly Jorgen These administrative accounts are allowed to be delegated to a service: Administrator April krbtgt Passwords of these accounts will never expire: Administrator Guest These accounts are not required to have a password: Guest Magnus Maria #> |
Although the cmdlet output is formatted in a human readable fashion, it is still an object, whose properties can be accessed separately (e.g. $result.WeakPassword) to produce a desired output.
Credits
I would like to thank Jakob Heidelberg for his idea to use the DSInternals module for password auditing. A big thank you also goes to Ondrej Sevecek for sharing his comprehensive auditing tool called SAPHA, from which I borrowed ideas for a few tests.
Tags: Active Directory, PowerShell, Security
Dumping and Modifying Active Directory Database Using a Bootable Flash Drive
July 19, 2016 | Michael Grafnetter | No Comments on Dumping and Modifying Active Directory Database Using a Bootable Flash DriveSince version 2.15, the DSInternals PowerShell Module fully supports Windows PE, the free minimalistic edition of Windows. This means that all the nasty Active Directory database stuff can now be performed from a bootable flash drive or an ISO image, including:
- Dumping NT hashes, kerberos keys and cleartext passwords from ntds.dit files.
- Modifying the SID History of user accounts and groups.
- Modifying the Primary Group ID of user accounts.
- Extracting the DPAPI domain backup keys.
Required access
These actions would of course require an attacker to have one of the following:
- Physical access to a domain controller (DC).
- Knowledge of DC’s baseboard management controller (BMC) credentials.
- Administrative access to a virtualized DC.
In an ideal world, only Domain Admins should have such non-trivial access to the core AD infrastructure, but the everyday reality is far from perfect.
Creating the media
To create a bootable Windows PE media loaded with the DSInternals module, follow these steps:
- Install the Windows Assessment and Deployment Kit (ADK), including the Windows PE feature.
- Click Start, and type deployment. Right-click Deployment and Imaging Tools Environment and then select Run as administrator.
- Create a working copy of the Windows PE files. Specify either x86 or amd64:
1copype amd64 C:\WinPE_amd64 - Mount the Windows PE image:
1Dism /Mount-Image /ImageFile:"C:\WinPE_amd64\media\sources\boot.wim" /index:1 /MountDir:"C:\WinPE_amd64\mount" - Add PowerShell support to Windows PE by adding a few optional components, together with their associated language packs:
1234567891011Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-WMI.cab"Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-WMI_en-us.cab"Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-NetFX.cab"Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-NetFX_en-us.cab"Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab"Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab"Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-PowerShell.cab"Dism /Add-Package /Image:"C:\WinPE_amd64\mount" /PackagePath:"C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-PowerShell_en-us.cab" - Add the DSInternals PowerShell module to the Windows PE image by copying it into the C:\WinPE_amd64\mount\Windows\system32\ WindowsPowerShell\v1.0\Modules folder.
- Add device drivers to the Windows PE image:
1Dism /Add-Driver /Image:"C:\WinPE_amd64\mount" /Driver:"C:\DriversToEmbed" /Recurse - Configure PowerShell to start automatically after boot by creating a file called winpeshl.ini in the C:\WinPE_amd64\mount\Windows\system32 folder, containing this text:
123[LaunchApps]wpeinit.exepowershell.exe, -NoExit -NoLogo -ExecutionPolicy Bypass - Create an ISO file containing the Windows PE files:
1MakeWinPEMedia /ISO C:\WinPE_amd64 C:\WinPE_amd64\WinPE_amd64.isoThe same command can be used to create a bootable flash drive or VHD.
Final thoughts
As you have seen, it is pretty straightforward to create a bootable flash drive that can be used to conquer an Active Directory domain through a physically accessible DC. One of the precautions a domain administrator can take is to encrypt all DCs using BitLocker or other tool that does full volume encryption. Deploying RODCs at smaller branch offices is also a good idea. The new features in Windows Server 2016, Virtual TPMs and Shielded VMs, also seem very promising in regards to DC security.
Tags: Active Directory, DPAPI, PowerShell, Security
How the Active Directory Expiring Links Feature Really Works
April 3, 2016 | Michael Grafnetter | 5 Comments on How the Active Directory Expiring Links Feature Really WorksOne of the new features in Windows Server 2016 will be the Active Directory Expiring Links feature, which enables time-bound group membership, expressed by a time-to-live (TTL) value. Here is how it works:
Enabling the Expiring Links Feature
The Expiring Links feature had been a standalone feature in early Windows Server 2016 builds, but as of TP4, it is a part of the broader Privileged Access Management (PAM) feature. It is disabled by default, because it requires Windows Server 2016 forest functional level. One of the ways to enable the PAM feature is running this PowerShell cmdlet:
1 |
Enable-ADOptionalFeature -Identity 'Privileged Access Management Feature' -Target (Get-ADForest) -Scope ForestOrConfigurationSet |
Note that once this feature is enabled in a forest, it can never be disabled again.
Creating Expiring Links using PowerShell
Unfortunately, this feature is not exposed in any GUI (yet), so you cannot create expiring links, nor can you tell the difference between a regular link and an expiring one. We will therefore use PowerShell to do the job:
1 2 3 4 5 6 7 8 9 10 11 |
# Add user PatColeman to the Domain Admins group for the next 2 hours $ttl = New-TimeSpan -Hours 2 Add-ADGroupMember -Identity 'Domain Admins' -Members PatColeman -MemberTimeToLive $ttl # Show group membership with TTL Get-ADGroup -Identity 'Domain Admins' -ShowMemberTimeToLive -Properties member | Select-Object -ExpandProperty member <# Output: <TTL=6987>,CN=PatColeman,CN=Users,DC=adatum,DC=com CN=Administrator,CN=Users,DC=adatum,DC=com #> |
As we can see, the TTL value in the output is in seconds (2h = 7200s). As soon as the TTL expires, the DCs will automatically remove user PatColeman from the Domain Admins group and his current Kerberos tickets will also expire.
Creating Expiring Links using LDAP
PowerShell is great, but what if we needed to stick with pure LDAP? Well, if you want to add a user into a group for a limited amount of time, you do it exactly as you are used to, but you have to specify his distinguished name (DN) in the new TTL-DN form: <TTL=TimeToLive,DN>. In our sample case, it would look like this:
<TTL=7200,CN=PatColeman,CN=Users,DC=adatum,DC=com>
To view the group membership with TTLs, the corresponding LDAP search operation has to contain the LDAP_SERVER_LINK_TTL extended control (OID = 1.2.840.113556.1.4.2309). Here is a screenshot from the ldp.exe tool with this control enabled:
Implementation Details (Very Advanced Stuff)
I was also quite interested in how this feature is implemented in the ntds.dit file. I have found out that as soon as you enable the PAM feature, the DCs automatically extend their database schemas in the following way:
- The expiration_time_col column is added to the link_table table. It contains timestamps (in the UTC FILETIME / 107 format), after which the links get deactivated. This is yet another reason for the time to be in sync between DCs.
- The link_expiration_time_index index is added to the link_table table. It is created over these columns: expiration_time_col, link_DNT, backlink_DNT. Thanks to this index, DCs can find expired links very quickly.
Tags: Active Directory, LDAP, PowerShell, Security
New Version Released
February 3, 2016 | Michael Grafnetter | 9 Comments on New Version ReleasedI am happy to announce that a new version of the DSInternals PowerShell Module has been released, now with Windows Server 2003 support.
Tags: Active Directory, PowerShell, Security
Retrieving Cleartext GMSA Passwords from Active Directory
December 28, 2015 | Michael Grafnetter | 8 Comments on Retrieving Cleartext GMSA Passwords from Active DirectoryHave you ever wondered how the automatically generated passwords of Group Managed Service Accounts (GMSA) look like? Well, you can fetch them from Active Directory in the same way as Windows Servers do and see yourself. Here is how:
Creating a GMSA
To start experimenting, we need to have a GMSA first, so we create one:
1 2 3 4 5 6 7 |
# Create a new KDS Root Key that will be used by DC to generate managed passwords Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10) # Create a new GMSA New-ADServiceAccount ` -Name 'SQL_HQ_Primary' ` -DNSHostName 'sql1.adatum.com' |
We can check the result in the Active Directory Users and Computers console:
Unfortunately, the built-in GUI will not help us much when working with GMSAs. Although there is a nice 3rd party tool, we will stick to PowerShell.
Setting the Managed Password ACL
Now we need to provide a list of principals that are allowed to retrieve the plaintext password from DCs through LDAP. Normally, we would grant this privilege to one or more servers (members of the same cluster/web farm). But we will grant the privilege to ourselves instead:
1 2 3 |
Set-ADServiceAccount ` -Identity 'SQL_HQ_Primary' ` -PrincipalsAllowedToRetrieveManagedPassword 'Administrator' |
Of course, you should not use the built-in Administrator account in a production environment.
Retrieving the Managed Password
Now comes the fun part:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# We have to explicitly ask for the value of the msDS-ManagedPassword attribute. Even a wildcard (*) would not work. Get-ADServiceAccount ` -Identity 'SQL_HQ_Primary' ` -Properties 'msDS-ManagedPassword' <# Output: DistinguishedName : CN=SQL_HQ_Primary,CN=Managed Service Accounts,DC=Adatum,DC=com Enabled : True msDS-ManagedPassword : {1, 0, 0, 0...} Name : SQL_HQ_Primary ObjectClass : msDS-GroupManagedServiceAccount ObjectGUID : 5f8e24c5-bd21-43a4-95ab-c67939434e81 SamAccountName : SQL_HQ_Primary$ SID : S-1-5-21-3180365339-800773672-3767752645-4102 UserPrincipalName : #> |
Note that until now, we have only used regular, built-in cmdlets from the ActiveDirectory module, courtesy of Microsoft.
Decoding the Managed Password
Let’s have a look at the msDS-ManagedPassword attribute, that has been returned by the command above. It is a constructed attribute, which means that its value is calculated by DC from the KDS root key and the msDS-ManagedPasswordId attribute every time someone asks for it. Although documented, the cryptographic algorithm used is quite complicated. Furthermore, the value of the msDS-ManagedPasswordId gets re-generated every (msDS-ManagedPasswordInterval)-days (30 by default).
We see that the msDS-ManagedPassword attribute of our GMSA contains a sequence of bytes. It is a binary representation of the MSDS-MANAGEDPASSWORD_BLOB data structure, which contains some metadata in addition to the actual password. As there had been no publicly available tool to decode this structure, I have created one myself:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# Save the blob to a variable $gmsa = Get-ADServiceAccount ` -Identity 'SQL_HQ_Primary' ` -Properties 'msDS-ManagedPassword' $mp = $gmsa.'msDS-ManagedPassword' # Decode the data structure using the DSInternals module ConvertFrom-ADManagedPasswordBlob $mp <# Output: Version : 1 CurrentPassword : 湤ୟɰ橣낔饔ᦺ几᧾ʞꈠ⿕ՔὬ랭뷾햾咶郸�렇ͧ퀟럓몚ꬶ佩䎖∘Ǐ㦗ן뱷鼹⽩Ⲃ⫝咽㠅E䠹鸞왶婰鞪 PreviousPassword : QueryPasswordInterval : 29.17:15:36.3736817 UnchangedPasswordInterval : 29.17:10:36.3736817 #> |
TADA!!! The CurrentPassword property contains the actual cleartext password of the GMSA in question. Why does it look like gibberish? Because it is just 256 bytes of pseudorandom data, interpreted as 128 UTF-16 characters. Good luck writing that on your keyboard. But if we calculate its NT hash, it will match the hash stored in AD.
Conclusion
We have seen that retrieving the value of GMSA passwords is quite easy. But don’t be afraid, there is no security hole in Active Directory. The cleartext password is always passed through an encrypted channel, it is automatically changed on a regular basis and even members of the Domain Admins group are not allowed to retrieve it by default. So do not hesitate and start using the (Group) Managed Service Accounts. They are much safer than using regular accounts for running services.
If you want to play more with this stuff, just grab the DSInternals module. And for developers, the C# code I use to decode the structure can be found on GitHub.
Tags: Active Directory, LDAP, PowerShell, Security