AD1 Introduction and Terminology

1. What is Active Directory?

🔊

Active Directory (AD) is a directory service for Windows enterprise environments that Microsoft officially released in 2000 with Windows Server 2000. Microsoft has been incrementally improving AD with the release of each new server OS version. Based on the protocols x.500 and LDAP that came before it (which are still utilized in some form today), AD is a distributed, hierarchical structure that allows centralized management of an organization’s resources, including users, computers, groups, network devices and file shares, group policies, devices, and trusts. AD provides authentication, accounting, and authorization functionalities within a Windows enterprise environment. It also allows administrators to manage permissions and access to network resources.

Active Directory（AD） 是一種用於 Windows 企業環境的目錄服務，Microsoft 在 2000 年隨著 Windows Server 2000 正式推出。之後每一代新的伺服器作業系統都持續改進 AD。
AD 建立在更早以前的 x.500 與 LDAP 協定概念上（而且這些概念到今天仍然在某些形式中被使用）。
它是一種分散式、階層式的架構，可以讓組織集中管理各種資源，包括：

• 使用者
• 電腦
• 群組
• 網路設備
• 檔案分享
• 群組原則（Group Policy）
• 裝置
• 信任關係（trusts）
  AD 在 Windows 企業環境中提供：
• Authentication（驗證）
• Accounting（帳務／記錄／追蹤）
• Authorization（授權）
  同時也讓系統管理員可以管理權限與網路資源的存取。

2. Why is AD so important?

🔊

Active Directory is so widespread that it is by a margin the most utilized Identity and Access Management (IAM) solution worldwide. For this reason, the vast majority of enterprise applications seamlessly integrate and operate with Active Directory. Active Directory is the most critical service in any enterprise. A compromise of an Active Directory environment means unrestricted access to all its systems and data, violating its CIA (Confidentiality, Integrity, and Availability). Researchers constantly discover and disclose vulnerabilities in AD. Via these vulnerabilities, threat actors can utilize malware known as ransomware to hold an organization’s data hostage for ransom by performing cryptographic operations (encryption) on it, therefore rendering it useless until they either pay a fee to purchase a decryption key (not advised) or obtain the decryption key with the help of IT Security professionals. However, if we think back, an Active Directory compromise means the compromise of all and any applications, systems, and data instead of a single system or service.

Active Directory 非常普及，放眼全球，它幾乎是使用最廣泛的 身份與存取管理（IAM） 解決方案。
因此，大多數企業應用程式都能與 Active Directory 無縫整合並運作。
在任何企業中，AD 幾乎都是最關鍵的服務之一。

如果 Active Directory 環境遭到入侵，就代表攻擊者可能能不受限制地存取所有系統與資料，破壞資訊安全中的 CIA：

• Confidentiality（機密性）
• Integrity（完整性）
• Availability（可用性）

研究人員持續在 AD 中發現並揭露漏洞。攻擊者可以利用這些漏洞，配合像是 ransomware（勒索軟體） 之類的惡意程式，對組織的資料進行加密，將資料挾持作為勒索手段。資料一旦被加密，就會變得無法使用，除非受害者付費購買解密金鑰（不建議），或由資安專業人員協助找回解密方法。
更重要的是，AD 一旦被攻破，通常代表的不只是「某一個服務」被攻破，而是整個企業中的所有應用、系統與資料都可能一起被波及。

3. Patch Management and defensive thinking

🔊

Let’s look at publicly disclosed vulnerabilities for the past three years (2020 to 2022). Microsoft has over 3000, and around 9000 since 1999, which signifies an incredible growth of research and vulnerabilities in the past years. The most apparent practice to keep Active Directory secure is ensuring that proper Patch Management is in place, as patch management is currently posing challenges to organizations worldwide. For this module, we will assume that Patch Management is done right (Proper Patch Management is crucial for the ability to withstand a compromise) and focus on other attacks and vulnerabilities we can encounter. We will focus on showcasing attacks that abuse common misconfigurations and Active Directory features, especially ones that are very common/familiar yet incredibly hard to eliminate. Additionally, the protections discussed here aim to arm us for the future, helping us create proper cyber hygiene. If you are thinking Defence in depth, Network segmentation, and the like, then you are on the right track.

讓我們來看過去三年（2020 到 2022）公開揭露的漏洞。Microsoft 的漏洞數量已經超過 3000 個，而從 1999 年以來更是累積約 9000 個，這顯示近年來研究與漏洞揭露的數量都大幅成長。
要確保 Active Directory 安全，最明顯也最基本的做法就是做好 Patch Management（修補管理），而這件事目前對全球許多組織來說仍是很大的挑戰。

在這個模組中，我們先假設修補管理已經做得不錯（因為良好的修補管理對抵抗入侵非常重要），接著把重點放在其他可能遇到的攻擊與漏洞上。
這裡特別會介紹那些濫用 常見錯誤設定 與 AD 本身功能特性 的攻擊，尤其是那些很常見、大家也很熟，但卻非常難徹底消除的問題。

此外，這裡提到的防護觀念也是為了幫助我們建立更好的未來防禦能力，也就是良好的 cyber hygiene（資安衛生）。
如果你想到的是 defence in depth（縱深防禦）、network segmentation（網路分段） 等觀念，那你的方向就是對的。

4. Refresher

Domain 網域

A domain is a group of objects that share the same AD database, such as users or devices.
Domain（網域） 是一群共用同一個 AD 資料庫的物件集合，例如使用者或裝置。

Tree 樹狀結構

A tree is one or more domains grouped. Think of this as the domains test.local, staging.test.local, and preprod.test.local, which will be in the same tree under test.local. Multiple trees can exist in this notation.
Tree（樹） 是由一個或多個網域組合而成。
例如 test.local、staging.test.local、preprod.test.local，它們都可以被視為屬於 test.local 底下同一棵樹的一部分。
而且系統中可以存在多棵樹。

Forest 森林

A forest is a group of multiple trees. This is the topmost level, which is composed of all domains.
Forest（樹系 / 森林） 是由多棵樹組成的集合。
它是 AD 架構中的最高層級，由所有網域共同構成。

Organizational Units (OU) 組織單位

Organizational Units (OU) are Active Directory containers containing user groups, Computers, and other OUs.
OU（組織單位） 是 Active Directory 裡的容器，可以放使用者群組、電腦物件，甚至其他 OU。

Trust 信任關係

Trust can be defined as access between resources to gain permission/access to resources in another domain.
Trust（信任關係） 可以定義為：不同網域之間為了讓資源能互相授權與存取，而建立的信任機制。

Domain Controller 網域控制站

Domain Controller is (generally) the Admin of the Active Directory used to set up the entire Directory. The role of the Domain Controller is to provide Authentication and Authorization to different services and users. In Active Directory, the Domain Controller has the topmost priority and has the most authority/privileges.
Domain Controller（DC，網域控制站） 一般來說是 Active Directory 中負責建立與維護整個目錄服務的核心系統。
它的角色是為不同服務與使用者提供 驗證（Authentication） 與 授權（Authorization）。
在 Active Directory 中，Domain Controller 具有最高等級的重要性，也擁有最多的權限與控制能力

Active Directory Data Store AD資料儲存區

Active Directory Data Store contains Database files and processes that store and manages directory information for users, services, and applications. Active Directory Data Store contains the file NTDS.DIT, the most critical file within an AD environment; domain controllers store it in the %SystemRoot%\NTDS folder.
Active Directory Data Store 包含用來儲存與管理使用者、服務、應用程式等目錄資訊的資料庫檔案與相關程序。
其中包含 NTDS.DIT 這個檔案，它是 AD 環境中最關鍵的檔案之一；Domain Controller 會將它存放在 %SystemRoot%\NTDS 資料夾中。

5. What can a normal AD user enumerate?

A regular AD user account with no added privileges can be used to enumerate the majority of objects contained within AD, including but not limited to:
一個一般的 AD 使用者帳號，就算沒有額外權限，通常也可以用來列舉 AD 中大多數的物件，包括但不限於：

• Domain Computers 網域電腦
• Domain Users 網域使用者
• Domain Group Information 網域群組資訊
• Default Domain Policy 預設網域原則
• Domain Functional Levels 網域功能等級
• Password Policy 密碼政策
• Group Policy Objects (GPOs) 群組原則物件（GPO）
• Kerberos Delegation Kerberos 委派設定
• Domain Trusts 網域信任關係
• Access Control Lists (ACLs) 存取控制清單（ACL）

Although the settings of AD allow this default behavior to be modified/disallowed, its implications can result in a complete breakdown of applications, services, and Active Directory itself.
雖然 AD 的設定可以修改或禁止這種預設行為，但這些設定若改得太過頭，也可能導致應用程式、服務甚至整個 AD 本身運作崩潰。

6. LDAP

🔊

LDAP is a protocol that systems in the network environment use to communicate with Active Directory. Domain Controller(s) run LDAP and constantly listen for requests from the network.

LDAP 是網路環境中的系統拿來與 Active Directory 溝通的一種協定。
Domain Controller 會執行 LDAP 服務，並持續監聽來自網路的請求。

7. Authentication in Windows Environments

Authentication in Windows Environments:

Windows 環境中的驗證方式：

1. Username/Password, stored or transmitted as password hashes (LM, NTLM, NetNTLMv1 / NetNTLMv2).
   使用者名稱 / 密碼，並且可能以密碼雜湊形式儲存或傳輸，例如：
   • LM
   • NTLM
   • NetNTLMv1
   • NetNTLMv2
2. Kerberos tickets (Microsoft’s implementation of the Kerberos protocol). Kerberos acts as a trusted third party, working with a domain controller (DC) to authenticate clients trying to access services. The Kerberos authentication workflow revolves around tickets that serve as cryptographic proof of identity that clients exchange between each other, services, and the DC.
   Kerberos 票證（Microsoft 對 Kerberos 協定的實作）。
   Kerberos 扮演可信任第三方的角色，與 Domain Controller 協同工作，驗證嘗試存取服務的用戶端。
   Kerberos 的驗證流程圍繞著各種票證，這些票證是加密學上的身分證明，會在用戶端、服務與 DC 之間交換。
3. Authentication over LDAP. Authentication is allowed via the traditional username/password or user or computer certificates.
   透過 LDAP 進行驗證。可使用傳統帳號密碼，或使用者 / 電腦憑證來完成驗證。

8. KDC, TGT, TGS

Key Distribution Center (KDC): a Kerberos service installed on a DC that creates tickets. Components of the KDC are the authentication server (AS) and the ticket-granting server (TGS).
KDC（Key Distribution Center，金鑰分發中心） 是安裝在 Domain Controller 上的 Kerberos 服務，負責建立票證。
KDC 由兩個主要組成部分構成：

• AS（Authentication Server，驗證伺服器）
• TGS（Ticket Granting Server，票證授權伺服器）
  Kerberos Tickets are tokens that serve as proof of identity (created by the KDC):
  Kerberos Tickets（Kerberos 票證） 是由 KDC 建立、用來證明身分的 token：
• TGT is proof that the client submitted valid user information to the KDC.
  TGT（Ticket Granting Ticket）：證明用戶端已經向 KDC 提交了有效的使用者資訊。
• TGS is created for each service the client (with a valid TGT) wants to access.
  TGS（Service Ticket）：當用戶端已持有有效的 TGT，想要存取某個服務時，KDC 會再簽發對應該服務的 TGS。

9. KDC key / KRBTGT

🔊

KDC key is an encryption key that proves the TGT is valid. AD creates the KDC key from the hashed password of the KRBTGT account, the first account created in an AD domain. Although it is a disabled user, KRBTGT has the vital purpose of storing secrets that are randomly generated keys in the form of password hashes. One may never know what the actual password value represents (even if we try to configure it to a known value, AD will automatically override it to a random one).

KDC key 是用來證明 TGT 有效性的加密金鑰。
AD 會根據 KRBTGT 帳號的密碼雜湊來產生這把 KDC 金鑰。
KRBTGT 是 AD 網域建立時最早出現的帳號之一。雖然它是一個停用帳號，但它的重要功能是保存那些以密碼雜湊形式存在、隨機產生的秘密金鑰。
一般情況下，你並不會真正知道它實際密碼值代表什麼；即使試圖手動設成已知值，AD 也會自動將其覆寫為隨機值。

10. Privileged groups in Active Directory

🔊

Each domain contains the groups Domain Admins and Administrators, the most privileged groups in broad access. By default, AD adds members of Domain Admins to be Administrators on all Domain joined machines and therefore grants the rights to log on to them. While the ‘Administrators’ group of the domain can only log on to Domain Controllers by default, they can manage any Active Directory object (e.g., all servers and therefore assign themselves the rights to log on to them). The topmost domain in a forest also contains an object, the group Enterprise Admins, which has permissions over all domains in the forest.

每個網域中都包含 Domain Admins 與 Administrators 這兩個群組，它們是擁有廣泛存取權限的高權限群組。
預設情況下，AD 會將 Domain Admins 的成員加入所有已加入網域的主機上的 Administrators 群組，因此也賦予他們登入這些主機的權限。
雖然網域中的 Administrators 群組成員預設只能登入 Domain Controller，但他們可以管理任何 Active Directory 物件（例如所有伺服器），因此也可以替自己賦予登入那些系統的權利。
而在整個 forest 的最上層網域中，還有一個群組叫做 Enterprise Admins，它對 forest 中的所有網域都擁有權限。

11. Hidden danger in default privileged groups

🔊

Default groups in Active Directory are heavily privileged and carry a hidden risk. For example, consider the group Account Operators. When asking AD admins what the reason is to assign it to users/super users, they will respond that it makes the work of the ‘Service Desk’ easier as then they can reset user passwords. Instead of creating a new group and delegating that specific right to the Organizational Units containing user accounts, they violate the principle of least privilege and endanger all users. Subsequently, this will include an escalation path from Account Operators to Domain Admins, the most common one being through the ‘MSOL’ user accounts that Azure AD Connect creates upon installation. These accounts are placed in the default ‘Users’ container, where ‘Account operators’ can modify the user objects.

Active Directory 中的預設群組通常擁有很高的權限，而且帶有隱藏風險。
例如 Account Operators 這個群組。當你問 AD 管理員為什麼要把使用者加入這個群組時，他們常會回答：因為這樣 Service Desk 比較方便，可以幫使用者重設密碼。
但問題在於，他們沒有另外建立一個只具備特定權限的新群組，並把這個權限只委派到存放使用者帳號的 OU，而是直接使用內建高權限群組。這樣就違反了 least privilege（最小權限原則），也讓所有使用者面臨風險。
接著，這樣的配置還可能形成從 Account Operators 升權到 Domain Admins 的路徑。最常見的例子之一，就是 Azure AD Connect 安裝時建立的 MSOL 使用者帳號。這些帳號會被放在預設的 Users 容器中，而 Account Operators 可以修改這些使用者物件。

12. Logon types matter

🔊

It is essential to highlight that Windows has multiple logon types: ‘ how’ users log on to a machine, which can be, for example, interactive while a user is physically present on a device or remotely over RDP. Logon types are essential to know about because they will leave a ‘trace’ behind on the system(s) accessed. This trace is the username and password used. As a rule of thumb, logon types except ‘Network logon, type 3’ leave credentials on the system authenticated and connected to. Microsoft provides a complete list of logon types here.

必須特別強調的是，Windows 有多種 logon type（登入類型），也就是使用者「如何」登入一台機器。
例如，可能是使用者實際坐在裝置前進行的互動式登入，也可能是透過 RDP 遠端登入。
了解這些登入類型非常重要，因為不同的登入方式會在被存取的系統上留下不同的「痕跡」。
這些痕跡可能包括使用過的帳號與密碼相關資訊。
一般來說，可以先記一個經驗法則：
除了 Network logon（類型 3） 之外，其他很多登入類型都可能會在被登入的系統上留下憑證。

13. Talking to Active Directory: LDAP and management tools

🔊

To interact with Active Directory, which lives on Domain Controllers, we must speak its language, LDAP. Any query happens by sending a specifically crafted message in LDAP to a Domain Controller, such as obtaining user information and a group’s membership. Early in its life, Microsoft realized that LDAP is not a ‘pretty’ language, and they released Graphical tools that can present data in a friendly interface and convert ‘mouse clicks’ into LDAP queries. Microsoft developed the Remote Server Administration Tools (RSAT), enabling the ability to interact with Active Directory locally on the Domain Controller or remotely from another computer object. The most popular tools are Active Directory Users and Computers (which allows for accessible viewing/moving/editing/creating objects such as users, groups, and computers) and Group Management Policy (which allows for the creation and modification of Group policies).

要與 Active Directory 互動，而 AD 又是運作在 Domain Controller 上，我們就必須使用它的語言，也就是 LDAP。
任何查詢本質上都是送出一個特別設計的 LDAP 訊息到 Domain Controller，例如查詢使用者資訊或群組成員關係。

在早期，Microsoft 很快就發現 LDAP 並不是一種「好看又好操作」的語言，所以他們推出了圖形化工具，將資料以較友善的介面呈現，並把使用者的滑鼠操作轉換成 LDAP 查詢。

Microsoft 開發了 RSAT（Remote Server Administration Tools，遠端伺服器管理工具），讓管理員可以直接在 Domain Controller 本機上，或從其他電腦遠端與 AD 互動。
其中最常見的工具包括：

• Active Directory Users and Computers（ADUC）：可用來檢視、移動、編輯、建立使用者、群組、電腦等物件
• Group Management Policy / Group Policy Management（GPMC）：可用來建立與修改群組原則

14. Important network ports in Windows environments

Important network ports in any Windows environment include (memorizing them is hugely beneficial):
任何 Windows 環境中都很重要的網路連接埠包括（把它們記起來非常有幫助）：

• 53: DNS
• 88: Kerberos
• 135: WMI / RPC
• 137-139 & 445: SMB
• 389 & 636: LDAP
• 3389: RDP
• 5985 & 5986: PowerShell Remoting (WinRM)

15. Real-world view

15-1 Why classification matters

Every organization, which has (attempted) at some point to increase its maturity, has gone through exercises that classify its systems. The classification defines the importance of each system to the business, such as ERP, CRM, and backups. A business relies on this to successfully meet its objectives and is significantly different from one organization to another. In Active Directory, any additional roles, services, and features that get ‘added’ on top of what comes out of the box must be classified. This classification is necessary to ensure that we set the bar for which service, if compromised, poses an escalation risk toward the rest of Active Directory. In this design view, we need to ensure that any service allowing for direct (or indirect) escalation is treated similarly as if it was a Domain Controller/Active Directory. Active Directory is massive, complex, and feature-heavy - potential escalation risks are under every rock. Active Directory will provide services such as DNS, PKI, and Endpoint Configuration Manager in an enterprise organization. If an attacker were to obtain administrative rights to these services, they would indirectly have means to escalate their privileges to those of an Administrator of the entire forest. We will demonstrate this through some attack paths described later in the module.

每個曾經試圖提升自身成熟度的組織，通常都做過一件事：對系統進行分類。
這種分類會定義每個系統對業務的重要性，例如：

• ERP
• CRM
• 備份系統

企業依賴這種分類來確保自己能順利達成營運目標，而且不同組織之間的分類方式也可能差很多。
在 Active Directory 環境中，任何在原生功能之上額外加入的角色、服務與功能，也都必須被分類。
這樣做是為了判斷：如果某個服務被攻破，它是否可能成為升權到整個 AD 的跳板。

從設計角度來看，任何能夠造成直接或間接升權的服務，都應該被視為和 Domain Controller / Active Directory 一樣重要。
Active Directory 本身規模龐大、結構複雜、功能繁多——幾乎每一塊石頭底下都可能藏著升權風險。
在企業中，AD 常常還會延伸提供像是：

• DNS
• PKI
• Endpoint Configuration Manager

等服務。
如果攻擊者取得了這些服務的管理權限，那他們就可能間接地把自己的權限一路升到整個 forest 的管理員等級。
之後課程會用具體攻擊路徑示範這件事。

15-2 AD limitations: complexity, design, legacy

Active Directory has limitations, however. Unfortunately, these limitations are a ‘weak’ point and expand our attack surface - some born by complexity, others by design, and some due to legacy and backward compatibility. For the sake of completeness, below are three examples of each:
不過，Active Directory 也有它本身的限制。
不幸的是，這些限制正好成為它的弱點，進一步擴大攻擊面——有些來自複雜性，有些來自設計本身，還有一些則來自歷史包袱與向下相容性。下面分別舉三個例子：

1. Complexity - The simplest example is figuring out nested group members. It is easy to get lost when looking into who is a member of a group, a member of another group, and a member of yet another group. While you may think this chain ends eventually, many environments have every ‘Domain user’ indirectly a member of ‘Domain Admins’.
   Complexity（複雜性）
   最簡單的例子就是追蹤巢狀群組（nested groups）成員。
   當你在看某個群組的成員，而這個成員又屬於另一個群組、另一個群組又再屬於別的群組時，很容易就迷路。
   你可能以為這條鏈總有一天會停下來，但在很多環境中，最後會發現幾乎所有 Domain Users 都可能間接擁有通往 Domain Admins 的路徑。

2. Design - Active Directory allows managing machines remotely via Group Policy Objects (GPOs). AD stores GPOs in a unique network share/folder called SYSVOL, where all domain-joined devices pull settings applied to them from. Because it is a network-shared folder, clients access SYSVOL via the SMB protocol and transfer stored information. Thus, for a machine to use new settings, it has to call a Domain Controller and pull settings from SYSVOL - this is a systematic process, which by default occurs every 90 minutes. Every device must have a Domain Controller ‘in sight’ to pull this data from. The downside of this is that the SMB protocol also allows for code execution (a remote command shell, where commands will be executed on the Domain Controller), so as long as we have a set of valid credentials, we can consistently execute code over SMB on the Domain Controllers remotely. This port/protocol is available to all machines toward Domain Controllers. (Additionally, SMB is not well fit (generally Active Directory) for the zero-trust concepts). If an attacker has a good set of privileged credentials, they can execute code as that account on Domain Controllers over SMB (at least).
   Design（設計）
   AD 允許透過 GPO（Group Policy Objects） 來遠端管理機器。
   AD 會把 GPO 儲存在一個特別的網路分享資料夾中，叫做 SYSVOL。
   所有加入網域的裝置都會從 SYSVOL 拉取套用到自己身上的設定。

   因為 SYSVOL 是網路分享資料夾，所以用戶端會透過 SMB 協定去存取 SYSVOL 並傳輸資訊。
   因此，機器要套用新的設定時，就必須聯絡 Domain Controller，並從 SYSVOL 抓取設定。這是一個系統性流程，預設每 90 分鐘 就會進行一次。
   每台裝置都必須「看得到」Domain Controller，才能抓到這些資料。

   問題在於，SMB 協定本身也允許遠端執行程式碼（例如遠端命令 shell，命令會在 Domain Controller 上執行）。
   所以只要我們擁有一組有效帳號憑證，就可以穩定地透過 SMB 在 Domain Controller 上遠端執行程式碼。
   這個 port / protocol 對所有機器到 Domain Controller 通常都是可用的。
   （另外，SMB 和整體 AD 架構一般來說也不太符合 zero-trust 的概念。）
   如果攻擊者擁有一組高權限憑證，那麼他們至少就能透過 SMB 以該帳號身分在 Domain Controller 上執行程式。

3. Legacy - Windows is made with a primary focus: it works out of the box for most of Microsoft’s customers. Windows is not secure by default. A legacy example is that Windows ships with the broadcasting - DNS-like protocols NetBIOS and LLMNR enabled by default. These protocols are meant to be used if DNS fails. However, they are active even when it does not. However, due to their design, they broadcast user credentials on the wire (usernames, passwords, password hashes), which can effectively provide privileged credentials to anyone listening on the wire by simply being there. This blog post demonstrates the abuse of capturing credentials on the wire.
   Legacy（歷史包袱）

   Windows 的主要設計目標之一是：讓大多數 Microsoft 客戶在安裝後可以直接使用。
   也就是說，Windows 並不是預設安全（not secure by default）。

   一個典型的歷史包袱例子是：Windows 預設啟用了像 NetBIOS 與 LLMNR 這種帶有廣播特性的、類似 DNS 的協定。
   這些協定原本是設計來在 DNS 失敗時作為備援使用。

   然而，由於它們的設計方式，它們可能會把使用者憑證資訊（例如使用者名稱、密碼、密碼雜湊）在網路上廣播出去。
   結果就是：任何只是在同一條網路上「聽」封包的人，都可能有機會攔截到高權限憑證。
   後面提到的那篇文章就是在示範如何濫用這種「線上擷取憑證」的問題。