Questions tagged [active-directory]

Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

Getting a shell from a windows machine [closed]

If you get creds for an account in active directory, can you simply use a standard PHP or bash script to get a reverse shell through cmd and catch it with netcat on the machine you're trying to make ...
0
votes
0answers
31 views

how to get a shell after you get admin credentials [closed]

so lets assume that somehow I got domain admin credentials in an active directory enviorment. How many different ways are there to get a shell after that .
1
vote
1answer
97 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
1
vote
0answers
30 views

How do you protect against Active Directory Golden Ticket Attacks?

I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that ...
0
votes
0answers
29 views

Should one Windows Server serve both high and low trust devices?

The high and low-trust devices themselves are separated by VLANs, however they both need to be connected to an Active Directory. The only way for the low-trust VLAN to access the high-trust VLAN would ...
0
votes
1answer
32 views

Azure Ad B2C Users access resources in other directory

I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
0
votes
0answers
45 views

Discover AD accounts with LM Hashes

During a recent security audit, we found that a handful of accounts still have credentials identified as stored in LM hash format. For us, these were ancient service accounts and the like - easy ...
1
vote
1answer
284 views

Is it possible make a Pass-The-Hash attack with Responder?

The tool Responder written in Python permits to listen on a specific network card requests and automatically poisoning victims the steal hash NTLMv1 and hash NTLMv2. The attack Pass-The-Hash permits ...
0
votes
0answers
55 views

Apply policy to specific users OR computers

I was directed to post my question here from stackoverflow. Need some guidance implementing a policy. Specifically a block removable storage policy. Let's say I have 100 computers named PC1-PC100. PC1-...
2
votes
1answer
73 views

Login with AD credentials on behalf of a user

We have a web solution (running in IIS) where AD users and non-AD users need to log into. We sell this to companies and will run this on-prem only. non-AD-FS and only AD question (so no federation) I ...
2
votes
2answers
82 views

Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
0
votes
1answer
143 views

How often should we force users to re-authenticate when not on the network?

Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
1
vote
1answer
68 views

Requiring an on-site visit to reset a password or get VPN access

This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
1
vote
0answers
25 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
0
votes
2answers
1k views

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. But with a domain ...
0
votes
1answer
95 views

Is kerberos unconstrained delegation partially safer than constrained delegation?

When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
0
votes
1answer
520 views

Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain

Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
0
votes
0answers
67 views

how to exploit user which I own according to bloodhound?

During a pentest, I succeeded to compromize a user with low privileges. As this is a domain user, I decided to run BloodHound based on its credentials to check whether there is a path from this user ...
1
vote
0answers
526 views

Active Directory authentication with a Login form ASP.NET MVC5

I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
2
votes
0answers
93 views

Best practices or advice to convince IT admins not to map network drives in privileged sessions with users

We are currently trying to enhance the security posture of our company, and this means changing how some IT personnel work. Put precisely, our IT helpdesk currently have 2 separate accounts: 1 for ...
1
vote
1answer
197 views

How do companies authenticate internal users in internal systems?

Assuming that a company has an AD/LDAP server with accounts for all employees and has many internal systems that must authenticate those users, what would be a good solution in terms of security best ...
3
votes
1answer
1k views

Active Directory Pentesting Methodologies

I would like to ask about steps and methodologies for Active Directory pentesting. I used tools like responder, powerview, pingcastle and mimikatz, but maybe there are other methods that are useful.
0
votes
0answers
30 views

critical files to be monitored by file integrity monitoring solutions in active directory servers

We are implementing file integrity solution on Microsoft active directory servers, I need to know the critical paths(files and folders and registry keys) that need to be monitored for any change or ...
3
votes
1answer
97 views

Lateral Movement: What is the benefit of Windows Hello For Business?

I work as a security researcher, tonight I implemented Windows Hello For Business in our environment, because it is marketed as the "passwordless way of the future" and I wanted to see if it holds up ...
0
votes
1answer
90 views

Identity management in a mixed Linux/Windows environment

At places like Google, where some users use Linux and others use Windows and even Mac, how are they managing IDAM? For example have a single directory service (probably highly customised)? is it ...
0
votes
0answers
33 views

Security and distro list naming convention in AAD

Most naming convention standards for Active Directory I have come across so far have security groups starting with an underscore to allow the equivalent distribution list to be user-friendly. I am ...
0
votes
1answer
78 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
1
vote
1answer
417 views

Active Directory GDPR classification

GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc. ...
0
votes
0answers
25 views

AD Security Group hunting

I have a problem that I have been pondering off and on for a while and I want to see if anyone has a better answer: Is there a way to see where an AD security group is used in an enterprise WITHOUT ...
0
votes
1answer
195 views

How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?

The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
1
vote
1answer
97 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
1
vote
0answers
214 views

How to decode kerberos tickets on wireshark? [closed]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
1
vote
1answer
91 views

AD user recreation, security issue

I have some users that prefer to create a new user account instead of resetting the password (or investigating why there is an issue with the account). Then delete the old account. I've personally ...
4
votes
1answer
197 views

ActiveDirectory PenTest Help [closed]

I'm popped in the middle of the domain with what appears to be a VERY solid network. Good policy, good security, a lot of the usual tactics won't work. I cant pass-the-hash, find any SYSVOL loot, or ...
3
votes
0answers
64 views

Good book detailing the security aspects of Microsoft Active Directory [closed]

I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
0
votes
0answers
62 views

Execute internal penetration test without touching Active Directory

I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year. This quarter, we've received buy-in from all org ...
1
vote
1answer
71 views

What is the logic behind Microsoft recommending that creation of “god group” / Tier -0 in their Red Forest model for AD?

Creating a Tier-0, which is basically a "God Group" in Red Forest AD model seems a bit off to me, so I was wondering about its logic.
1
vote
0answers
436 views

How to retrieve Kerberos Service tickets?

I am learning Kerberoasting see below are my steps that I am following. Step:1. Attacker will find the SPN's Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
1
vote
1answer
137 views

Running jobs as local administrator vs domain administrator and their risks

I know for best practices we should always give an account least privilege and use that account to run jobs etc. However our windows jobs often require elevated privileges in order to perform the ...
0
votes
1answer
331 views

How is Privileged identity management (PIM) different from privileged access management (PAM)?

I am very confused about those two, I was trying to understand the difference but it all sounds the same from what I read online.
1
vote
0answers
419 views

Use Kerberos Golden Ticket with Metasploit

Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
1
vote
0answers
87 views

How to intercept AD authentication attempts [closed]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
0
votes
1answer
1k views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
4
votes
1answer
273 views

What is the security concerns of AzureAD?

We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
1
vote
1answer
365 views

Getting VPN users to trust a non-global Root Certificate Authority on Windows in order to use TLS on intranet websites

Consider the following scenario, keeping in mind the restrictions: Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind ...
0
votes
0answers
69 views

CanRDP right set to computer account?

I was querying a domain and found an interesting ACL that I haven't seen before. One of the DomainComputer accounts has a CanRDP right set to another domain computer. How would this work? The domain ...
3
votes
1answer
208 views

Active Directory Server and Mimikatz

Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
1
vote
1answer
4k views

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks?

Disabling RC4 HMAC encryption in Windows Active Directory prevents current Kerberos attacks? I understand that RC4 HMAC encryption is dangerous in Windows Active Directory, since it relies on the ...
1
vote
1answer
87 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
68 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...

1
2 3 4 5