Questions tagged [active-directory]
Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.
262
questions
0
votes
0
answers
31
views
Secure authentication method for creating an Excel data connection to SQL Server
My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
- 1
2
votes
0
answers
84
views
Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray
TL;DR
I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
- 21
0
votes
1
answer
31
views
Shadow Credentials attack with TGT and TGS
I am trying to replicate Shadow Credentials attack in Active Directory environment. My initial approach was to:
Use Whisker to create a new certificate on behalf of DC (successful):
Whisker.exe add /...
- 101
1
vote
0
answers
63
views
Oracle Kerberos authentication on Linux host with SSSD
I have Linux servers which are members of AD domain, running SSSD demon.
SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication.
NOTE: this is not purely about ...
- 41
1
vote
1
answer
56
views
What information is contained in the local SAM in an Active Directory network
I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine?
I understand (and correct me if I'm wrong) that when logging in to ...
- 43
1
vote
1
answer
235
views
Kerberos - NTLM Password Hashes - Questions!
I have worked as a system administrator mainly on Widnows Server for some years now.
Over the course of time I've always had a hard time trying to fully understand how Kerberos work.
For about 3 weeks ...
0
votes
0
answers
36
views
Surreptitiously surveil a logged out laptop AD workstation's keyboard with temporary physical access?
I can think of multiple ways to surveil a logged out computer with temporary physical access. The first is installing a hardware keylogger which would enable one to get all the keystrokes from it; ...
0
votes
1
answer
288
views
Perfect DMZ: LDAP auth to AD
My goal is to integrate a public facing service with AD using LDAP.
While I vouch for federated approach to user authentication, the business dictates LDAP.
We run a DMZ subnet and I insist on not ...
- 281
0
votes
0
answers
53
views
Get exhaustive domain user rights on domain with Powerview/Powersploit
I am connected to a Windows workstation with a basic domain user account.
I have downloaded and installed Powersploit. I have also tried with Powerview.
There is a command called Get-DomainObjectAcl. ...
- 49
0
votes
0
answers
77
views
Sharphound / Bloodhound full enumeration
I am working with Sharphound / Bloodhound tools to create a "map" of my active directory domain. It works fine.
I have now a complex environment. There are multiple domains/forests. There is ...
- 49
0
votes
0
answers
35
views
simulating a domain user logon on machine startup
I'm currently working on a lab for AD penetration testing and want some of the machines to have a logon, including the TGT, for a specific domain user cached. So far I couldn't come up with anything ...
- 1
0
votes
0
answers
347
views
Encryption of NTDS.dit (BOOTKEY)
Looking around I found some information regarding NTDS.dit encryption and I wanted to learn a little bit more around the BOOTKEY and whether this is rotated each boot up sequence or is just held ...
- 153
2
votes
1
answer
44
views
Can you use AD CS to generate certificates for service users with the computer name in the certificate details?
I am working on seeing if Active Directory Certificate Services can be used to manage the trust infrastructure for a data center environment. I have a series of different services that are run on web ...
- 42.1k
1
vote
0
answers
143
views
Pass the hash/ pass the ticket TO a linux machine
I'm studying how to attack AD, but so far I have seen how to use pass the hash and pass the ticket to get access to Windows machines. How does one attack Linux machines joined to the domain using the ...
- 11
2
votes
0
answers
51
views
kerberoasting on a standard user domain account
Kerberoasting is an attack against domain service accounts.
I have a custom Windows service written in C#. This service is running on a Windows server. This server is a member of the Active Directory ...
- 49
0
votes
0
answers
31
views
I want to join our organisation AD with a recently acquired company's AD for federated access. What are the security risks I should consider?
As per the title. What risks and controls should I consider? Are there any questions i need to ask the external party AD before setting up the 'Trust' between the 2 ADs?
- 651
0
votes
1
answer
264
views
How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?
It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
- 101
0
votes
0
answers
83
views
Authorizing Access using AD with an API Gateway
We are developing a system that comprises of
Component A: Client Application
Component B: Gateway API
Component C: Backend Web API providing functionality (will be a set of
microservices C1, C2 etc)
...
- 1
0
votes
0
answers
108
views
Do using Invoke-Command with a domain admin account create a security issue?
Invoke-Command with a domain admin account is an easy way to do stuff across a domain. However, running Invoke-Command will create a win32 user profile that I believe has a hashed password attached to ...
- 1
0
votes
0
answers
42
views
Why the Active Directory App created using Visual Studio does not have any "Certificate & Secrets".. is this fine?
I created a new ASP.NET Core 6.0 MVC web application, and I define it to use Azure AD for authentication, as follows:
Then I was asked to create an owned application, so I created one named "ad&...
0
votes
0
answers
124
views
Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function
We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes).
Now for this Azure Function to integrate with SharePoint, we have created an ...
0
votes
1
answer
2k
views
Renewing Enterprise CA certificate
I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate.
My setup is the Root CA is offline with online issuing CA server.
When I do the renewal nothing ...
1
vote
1
answer
595
views
Why do I see LM hashes stored in Active Directory?
I'm using mimikatz to retrieve a user's password hashes from Active Directory with the following command:
lsadump::dcsync /user:mimikatz
The user's password is Pa55w.rd.
The output is
...
Credentials:...
- 364
0
votes
0
answers
111
views
How to leverage GenericAll privilege on a machine account without RBCD?
Suppose a domain user has a GenericAll permission on a machine account, but the computer tied to that machine account is inaccessible, and that same machine account has a GenericAll privilege over a ...
- 1
2
votes
0
answers
297
views
Active Directory and External Email Accounts
In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. jo[email protected]
Within the same AD we also have '...
- 129
2
votes
0
answers
936
views
Responder not collecting hashes in most cases
I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
- 21
0
votes
0
answers
49
views
Minimal permissions required to resolve Guid of Active Directory Object
As part of an application that I'm writing, I attempt to resolve an active directory object from Guid to the object's Distinguished name. For some restricted objects, I must grant my service account ...
- 33
2
votes
0
answers
195
views
Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?
When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
1
vote
1
answer
82
views
Web app architecture- set a new password for a on-premises AD setup
I need to implement a web app for a self-service change password use case for on-premise Active Directory users,
which is accessible over the internet.
The service must allow the users to set a new ...
- 111
0
votes
2
answers
107
views
Granting Local Admin permissions on domain workstations
We need to give local admin privileges on most workstations to our ERP software admin so he can install updates. He is not a domain admin, simply a domain user. However, we don't want him to have ...
0
votes
1
answer
42
views
How to prevent a user retaining file access with an open handle on Windows?
Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group.
Then, the user stops being a member of the group.
Since access checks are ...
- 4,891
4
votes
1
answer
387
views
Why did Microsoft publish the CPassword AES key ca. 2012?
As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more.
...
- 143
0
votes
1
answer
161
views
Should a standard user in a AD domain be able to open cmd prompt as Administrator?
I was given a standard non-admin user and a workstation to perform internal pentest assessment. To my surprise, I was able to open cmd prompt as administrator, use psexec and gain a SYSTEM shell ...
- 115
1
vote
0
answers
616
views
How to get the list of computers a user can RDP into using BloodHound?
Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into.
I looked at:
match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
- 11
0
votes
0
answers
28
views
Possible pitfalls with filesharing using local account instead of domain account
I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account.
I have exactly ...
- 1
1
vote
0
answers
146
views
Intercept API calls of powershell module
I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
- 11
0
votes
1
answer
824
views
TGS Ticket in Kerberoasting
In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password.
But in kerberoses authentication process , KRB_TGS_REQ request is ...
- 71
3
votes
0
answers
69
views
Active directory configuration on a shared remote workplace environment
Our need is to allow users to log in to their online workplace (e.g. using Citrix), and have access to their office applications, as well as some of the internally hosted applications the servers in ...
1
vote
3
answers
2k
views
Is there really any benefit in having a separate local admin account
I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
0
votes
1
answer
529
views
Why AD Kerberos uses password hash and not session key for tickets?
There is an attack on Active Directory named "Kerberoasting": https://attack.mitre.org/techniques/T1558/003/
I ask TGS for ticket to access some SPN
Part of this ticket is encrypted with ...
- 308
1
vote
1
answer
2k
views
How to extract Kerberos ticket from Wireshark?
I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
- 79
0
votes
1
answer
86
views
Active Directory Security Advice/Insight For Intranet Application
I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were:
Must authenticate against Active Directory
All ...
- 101
0
votes
1
answer
439
views
Hacked list of AD logins and passwords
An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
- 101
0
votes
0
answers
368
views
EFS-encrypted files not lost when domain admin resets password
There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user.
I tried:
Logged on as user (Domain User) with password 54321
...
- 101
5
votes
1
answer
3k
views
Any legitimate reason for notepad.exe to make network connections
Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
- 265
1
vote
1
answer
1k
views
Are Credentials used in RDP cached on Client?
When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash?
Example:
Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
- 11
0
votes
0
answers
332
views
What are security risks of a domain user accounts with denied interactive logon?
When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password?
http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
0
votes
1
answer
237
views
How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?
I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory
Application is using the below details in-...
- 159
0
votes
1
answer
116
views
Securing and storing Active Directory logs
If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
- 21
0
votes
1
answer
478
views
Read-Only Domain Controller (RODC) in Insecure Networks - Security Benefits
RODCs can be deployed in locations where physical security cannot be guaranteed, to improve the security. This is the primary use case where a RODC should be deployed.
An other scenario would be to ...
- 1