I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year.

This quarter, we've received buy-in from all org members except the Active Directory teams. They don't want us executing any AD-related attacks past user/passwd stuff. How could we safeguard the Active Directory environment from our engagement?

I've considered blocking ports 445 and 139 for all scanning/exploitation activity, but I don't really know if that'll even help, plus doing that reduces so much of our attack surface.

Please don't try explaining that this is a bad idea. I know. It's ridiculous. An attacker will never act in a network without attempting to hack AD. I've tried explaining this. Boss disagrees because if we attack the AD, we could knock it over. But again, the same point applies. No attacker will do this when they hack us, but whatever. I just need solutions.

  • Solutions to what, though? Just don't attack AD. I'm not sure what you are needing. What are your targets? All web services are fair game. Users are fair game. Going after weak credentials or default configs are fair game. Dropping USB sticks are fair game. Focusing on what you can't do only matters if it is a core component on what you want to do. – schroeder May 22 at 19:17
  • The problem is a matter of perception, I need to get approval from upper management to execute a red team assessment that won't affect AD, I need to provide assurances past, "we just won't attack AD." I need to either find a way to exclude AD entirely from the penetration test systematically, or I need to build a comprehensive list of the attacks were to attempt during the engagement – leaustinwile May 22 at 19:58
  • I can do the latter myself, I just thought I'd ask if anyone had any better solutions here. I don't really think this is a common problem, but hey, I have no clue. – leaustinwile May 22 at 19:59
  • 1
    I'm with schroeder, I don't understand what you're looking for unless you are planning to unleash automated scanning tools against this entire network with their 'safeties' turned off. It sounds like you need a better defined project scope that you can create after sitting down and talking with the AD teams so they can tell you what specific changes or impacts they're worried about. I wouldn't consider an activity like enumerating SMB shares 'attacking the AD', but maybe they do. – PwdRsch May 22 at 20:28
  • 1
    Title: "Executing internal penetration test." Comment: "this isn't supposed to be a penetration test." Now I'm more confused. – PwdRsch May 22 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.