Questions tagged [active-directory]
Active Directory (AD) is a directory service created by Microsoft for Windows domain networks. It provides a central location for network administration and security.
250
questions
0
votes
0
answers
18
views
Authorizing Access using AD with an API Gateway
We are developing a system that comprises of
Component A: Client Application
Component B: Gateway API
Component C: Backend Web API providing functionality (will be a set of
microservices C1, C2 etc)
...
- 1
0
votes
0
answers
11
views
Do using Invoke-Command with a domain admin account create a security issue?
Invoke-Command with a domain admin account is an easy way to do stuff across a domain. However, running Invoke-Command will create a win32 user profile that I believe has a hashed password attached to ...
- 1
0
votes
0
answers
12
views
Why the Active Directory App created using Visual Studio does not have any "Certificate & Secrets".. is this fine?
I created a new ASP.NET Core 6.0 MVC web application, and I define it to use Azure AD for authentication, as follows:
Then I was asked to create an owned application, so I created one named "ad&...
0
votes
0
answers
53
views
Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function
We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes).
Now for this Azure Function to integrate with SharePoint, we have created an ...
0
votes
1
answer
123
views
Renewing Enterprise CA certificate
I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate.
My setup is the Root CA is offline with online issuing CA server.
When I do the renewal nothing ...
1
vote
1
answer
90
views
Why do I see LM hashes stored in Active Directory?
I'm using mimikatz to retrieve a user's password hashes from Active Directory with the following command:
lsadump::dcsync /user:mimikatz
The user's password is Pa55w.rd.
The output is
...
Credentials:...
- 364
0
votes
0
answers
21
views
How to leverage GenericAll privilege on a machine account without RBCD?
Suppose a domain user has a GenericAll permission on a machine account, but the computer tied to that machine account is inaccessible, and that same machine account has a GenericAll privilege over a ...
- 1
2
votes
0
answers
66
views
Active Directory and External Email Accounts
In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. john@example.com
Within the same AD we also have '...
- 129
2
votes
0
answers
266
views
Responder not collecting hashes in most cases
I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
- 21
0
votes
0
answers
17
views
Minimal permissions required to resolve Guid of Active Directory Object
As part of an application that I'm writing, I attempt to resolve an active directory object from Guid to the object's Distinguished name. For some restricted objects, I must grant my service account ...
- 33
2
votes
0
answers
55
views
Can hashes labeled 'lm' in SAM database mimikatz dump be another type than (NT)LM?
When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory ...
1
vote
1
answer
43
views
Web app architecture- set a new password for a on-premises AD setup
I need to implement a web app for a self-service change password use case for on-premise Active Directory users,
which is accessible over the internet.
The service must allow the users to set a new ...
- 111
0
votes
2
answers
56
views
Granting Local Admin permissions on domain workstations
We need to give local admin privileges on most workstations to our ERP software admin so he can install updates. He is not a domain admin, simply a domain user. However, we don't want him to have ...
0
votes
0
answers
24
views
Smardcard-Login and LDAP-Webinterfaces
If "smartcard required" is ticked in an active directory user account the password is wiped.
In my enviroment there are a lot of applications with webinteface logins connected via ldap to AD....
0
votes
1
answer
33
views
How to prevent a user retaining file access with an open handle on Windows?
Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group.
Then, the user stops being a member of the group.
Since access checks are ...
- 4,610
0
votes
0
answers
92
views
Granting access to a Powershell script to read Windows Security event log (which approach is better?)
I want to be aware of any audit failure without installing any special service for some tiny network.
So, I created PowerShell script with Get-EventLog and Send-MailMessage and installed it as ...
- 308
0
votes
0
answers
276
views
SAMR Forensic Investigation
I am currently investigating on suspicious SAMR request on a specific domain.
From my knowledge, SAMR (i.e. SAM Request) is the act to ask directly a Domain Controller in order to take information, ...
- 1
4
votes
1
answer
214
views
Why did Microsoft publish the CPassword AES key ca. 2012?
As outlined in Security Bulletin MS14-025, Microsoft acknowledges the way credentials had been stored in the group policy field "CPassword" is insecure and is not to be trusted any more.
...
- 143
0
votes
1
answer
101
views
Should a standard user in a AD domain be able to open cmd prompt as Administrator?
I was given a standard non-admin user and a workstation to perform internal pentest assessment. To my surprise, I was able to open cmd prompt as administrator, use psexec and gain a SYSTEM shell ...
- 115
1
vote
0
answers
297
views
How to get the list of computers a user can RDP into using BloodHound?
Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into.
I looked at:
match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
- 11
0
votes
0
answers
21
views
Possible pitfalls with filesharing using local account instead of domain account
I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account.
I have exactly ...
- 1
1
vote
0
answers
90
views
Intercept API calls of powershell module
I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
- 11
0
votes
1
answer
294
views
TGS Ticket in Kerberoasting
In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password.
But in kerberoses authentication process , KRB_TGS_REQ request is ...
0
votes
0
answers
22
views
Abusing Saved mscash2 Credentials in Active Directory
Is it possible, with NT Authority/SYSTEM access, to reuse mscash2 credentials in any way on a local system or AD network? Perhaps with runas /savecred or mimikatz or something similar? I know that the ...
0
votes
0
answers
155
views
Kerberos TGT behavior after password change
I just want to confirm behavior of Kerberos and how the tickets work, as I only have a basic understanding. From what it sounds like, the user's password hash is only used to gain the initial TGT. ...
3
votes
0
answers
62
views
Active directory configuration on a shared remote workplace environment
Our need is to allow users to log in to their online workplace (e.g. using Citrix), and have access to their office applications, as well as some of the internally hosted applications the servers in ...
1
vote
3
answers
851
views
Is there really any benefit in having a separate local admin account
I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
0
votes
1
answer
253
views
Why AD Kerberos uses password hash and not session key for tickets?
There is an attack on Active Directory named "Kerberoasting": https://attack.mitre.org/techniques/T1558/003/
I ask TGS for ticket to access some SPN
Part of this ticket is encrypted with ...
- 308
1
vote
1
answer
792
views
How to extract Kerberos ticket from Wireshark?
I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
- 79
0
votes
1
answer
73
views
Active Directory Security Advice/Insight For Intranet Application
I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were:
Must authenticate against Active Directory
All ...
- 101
0
votes
1
answer
319
views
Hacked list of AD logins and passwords
An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
- 101
0
votes
0
answers
250
views
EFS-encrypted files not lost when domain admin resets password
There are many articles out there stating that a user's encrypted files are lost after an administrator resets the password of that user.
I tried:
Logged on as user (Domain User) with password 54321
...
- 101
5
votes
1
answer
2k
views
Any legitimate reason for notepad.exe to make network connections
Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
- 265
1
vote
1
answer
479
views
Are Credentials used in RDP cached on Client?
When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash?
Example:
Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
- 11
0
votes
0
answers
259
views
What are security risks of a domain user accounts with denied interactive logon?
When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password?
http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
0
votes
1
answer
195
views
How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?
I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory
Application is using the below details in-...
- 149
0
votes
1
answer
97
views
Securing and storing Active Directory logs
If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
- 21
0
votes
1
answer
329
views
Read-Only Domain Controller (RODC) in Insecure Networks - Security Benefits
RODCs can be deployed in locations where physical security cannot be guaranteed, to improve the security. This is the primary use case where a RODC should be deployed.
An other scenario would be to ...
- 1
1
vote
0
answers
113
views
Having Active Directory password length of more than 8 characters when that password is used to access mainframe systems
I am an intern with a Credit Union. I was surprised to find out that my Active Directory password length cannot be more than 8 characters. They use RACF for access to TSO or OMVS. I asked my mentor ...
- 21
1
vote
1
answer
670
views
Downgrade of NTLM Authentication
I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings.
In my understanding:
NTLM auth starts with a negotiation packet sent by the client. In this ...
- 33
1
vote
1
answer
365
views
How NTLM SSO is preformed on smartcard Kerberos logon?
I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved.
After an interactive logon with kerberos, you will have in the cached credentials both ...
- 33
1
vote
1
answer
304
views
Ways to exploit AD in context of Domain Computer account not as Domain user account?
There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account.
Now I ...
- 31
2
votes
1
answer
151
views
Risk associated with Exchange email address as username when AD authentication is enabled
In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
- 25
2
votes
0
answers
791
views
What legitimate services uses SAMR queries? And how to verify?
Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
- 21
1
vote
0
answers
395
views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
- 131
0
votes
0
answers
145
views
Non-malicious root causes for multiple failed logon in windows domain
While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt.
Assuming it was not an ...
- 21
1
vote
0
answers
101
views
Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?
I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow.
Now, every user must enter an e-...
- 2,183
1
vote
1
answer
185
views
Why do administrators create passwords vulnerable to kerberoasting? [closed]
I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
- 13
1
vote
0
answers
112
views
How do you protect against Active Directory Golden Ticket Attacks?
I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that ...
- 71
0
votes
1
answer
306
views
Azure Ad B2C Users access resources in other directory
I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...