DearSecurity

[DearSecurity @DearSecurity]

@techspence Look up delegated Managed Service Accounts (dMSA) pathway to admin. “Golden dMSA vulnerability”

[Sean Metcalf @PyroTek3]

Ensuring proper Domain Controller configuration is key for Active Directory security.

Part of this is making sure they are running supported versions of Windows.
At this point, DCs should be running at least Windows Server 2016, preferably Windows Server 2019 or 2022. Hold off on deploying Windows Server 2025 DCs for now due to the dMSA issue (https://t.co/cNwkhOdnB1).

Active Directory PowerShell code for Domain Controller operating system versions & site location for the current domain:
$DomainDCs = Get-ADDomainController -Filter *
$DomainDCs | Select HostName,IPv4Address,OperatingSystem,Site | `
Sort HostName | Format-Table -AutoSize

#ActiveDirectorySecurityTip

[Sean Metcalf @PyroTek3]

Want to detect Kerberoasting with no false positives?

Setup a honeypot account for detection following the guidance in this article:
https://t.co/2OjBvxbp6R

#ActiveDirectorySecurityTip

[spencer @techspence]

How to find insecure delegations in active directory

1. Download and run ADeleg
2. Click View -> Index view by -> Trustees
3. Look for: Everyone, Authenticated Users, Domain Users

Check the permissions on the right side to see if there's any privileged resources listed, such as Domain Admins, Domain Controllers, etc.

The value I have got from this one silly tool, that you probably haven't ever heard of before, is actually crazy...

Read more: https://t.co/EoUkh0anak

[Alex Neff @al3x_n3ff]

Releasing a side project of mine: wsuks - automating the WSUS mitm attack🔥
https://t.co/92D4idVy7V

TL;DR:
If the Windows Server Update Service (WSUS) is configured to use HTTP instead of HTTPS, it's possible to take control of any Windows machine on your local network.

1/4🧵

[DearSecurity @DearSecurity]

Block the items on the list at this site.

[spencer @techspence]

Super easy win for defenders… block everything from LoLRMM

https://t.co/hgbCMLgAgF

[DearSecurity @DearSecurity]

Consider MEAM

[James Spencer @__jcspencer]

@techspence Or put them in a Silo :)

https://t.co/OmlHyvm8iL

[DirectoryRanger @DirectoryRanger]

Active Directory Advanced Threat Hunting - Tracing the cause of account lockouts and password errors, by @tomvideo2brain #DFIR
https://t.co/EZjMbdkccL

[DirectoryRanger @DirectoryRanger]

Active Directory Hardening Series
Part 1 Disabling NTLMv1 https://t.co/9gla1vtQ18
Part 2 Removing SMBv1 https://t.co/KOqpamarcW
Part 3 Enforcing LDAP Signing https://t.co/oW2Ymvu1ZW
Part 4 Enforcing AES for Kerberos https://t.co/iENjEPBOFD

[Sarah Young @_sarahyo]

Okay so this is HUGE - our amazing AI red team have open sourced their AI red team labs so you can set up your own training!

https://t.co/brvdq6roHp

@ram_ssk

[DearSecurity @DearSecurity]

Dear Security @Microsoft please fix this.

[Yuval Gordon @YuG0rd]

🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️
Read Here - https://t.co/c969sNjQH0

[nix @aniqfakhrul]

1. Create a dMSA object (badmsa$) under sacrificial VulnOU and targeting Administrator identity. (you need a user with at least CreateChild privilege over an OU)
2. Request a service ticket as badmsa$
3. Retrieved ticket contains superseded identity's groups
4. DCSync

[Yuval Gordon @YuG0rd]

🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability
It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️
Read Here - https://t.co/c969sNjQH0

[Nathan McNulty @NathanMcNulty]

I often see User Administrator role given to helpdesk and sometimes support staff, like secretaries or librarians to help with password reset / user creation and attribute updates

⚠️ User Administrator has many paths to Global Admin or equivalent ⚠️

https://t.co/1HXjK7gC6U

[🇺🇦 Shikata 🇺🇦 @Shikata_VX]

To extend on this with some issues that were not mentioned but are just as important.

- SCCM site server relay: authentication coercion of the site server via petitpotam gives local admin everywhere
- MSSQL systems with signing off
- shared local admin passwords
- shared local to domain admin passwords
- shared credentials between low privilege and high privilege accounts. Aka Shikata and Shikata.admin have the same password.
- shared cross forest domain admins credentials
- the PCI/CDE or OT network has a trust with the main IT domain. Segmentation can be totally bypassed after domain compromise.
- flat network design and lack of any VLAN deployments to limit broadcast.
- printers or other systems configured with domain credentials but have default passwords themselves. (Authentication passback attacks)
- net-ntlmv1 enabled on domain controllers
- explicitly defined object control rights
- privileged users not being members of the protected users group.

I could go on.

[spencer @techspence]

Delegated permissions in Active Directory: silent but deadly 💩💨🤢

For example: Some random user with “FullControl” of the Domain Controllers OU

Nessus didn’t find it…
The IT team didn’t know it was there…
It wasn’t discovered on past pentests…

🧵I found it almost immediately...

[LetsDefend @LetsDefendIO]

Windows Directories Every SOC Analyst Should Know

[Jon Towles {MVP} @m0bilej0n]

@techspence https://t.co/3Kflt63bPU

[I am Jakoby @I_Am_Jakoby]

0 click NTLM hash grab!
This is actually one of the craziest exploits I have ever seen
Shoutout to @zeifan for the original POC
He was kind enough to share his version where simply right clicking the lnk file would send over the users password hashes

I did a little modification and you dont even have to click anything anymore
simply navigating to the directory where the malicious lnk file is triggers it and sends your password hashes to me!

This is truly one of the best exploits I have ever witnessed

[Jan Bakker @janbakker_]

Microsoft recently launched/refreshed guidance on how to protect against token theft and token replay:

1️⃣https://t.co/V5PcB20UC9

2️⃣https://t.co/3xICAUYu8W\

Go check!