Tweet
Tweet

Slide 1

Slide 1 text

Building Active Directory Lab for Red Teaming

Slide 2

Slide 2 text

#whoami 👉 Chirag Savla 👉 Twitter – @chiragsavla94 👉 Interest area – Red Teaming, Application Security, Penetration Testing 2 Blog – https://3xpl01tc0d3r.blogspot.com

Slide 3

Slide 3 text

“ Prevention is ideal, detection is a must

Slide 4

Slide 4 text

What is Active Directory ? â–¸ Active Directory is a directory service that centralizes the management of users, computers and other objects within a network. Its primary function is to authenticate and authorize users and computers in a windows domain. 4

Slide 5

Slide 5 text

What is Active Directory ? 5

Slide 6

Slide 6 text

What is Forest? 6 rtlabs.local sales.rtlabs.local accounts.rtlabs.local techno.local dev.techno.local sec.techno.local Domain Tree Domain Forest = Groups = Organizational Unit = Domain Trust Relationship = Users / Groups

Slide 7

Slide 7 text

Active Directory Components â–¸ Forest â–¸ Domain Trees â–¸ Domains â–¸ Schema â–¸ Objects â–¹ Organizational Units (OUs) â–¹ Groups â–¹ Users â–¹ Computer â–¸ Sites â–¸ Global Catalog (GC) â–¸ Group Policy â–¸ Domain Trust 7

Slide 8

Slide 8 text

Forest â–¸ An Active Directory forest (AD forest) is the top most logical container in an Active Directory configuration that contains domains, users, computers, and group policies. 8

Slide 9

Slide 9 text

Domain Tree â–¸ When you add a child domain to a parent domain you create what is called a domain tree. A domain tree is just a series of domains connected together in a hierarchical fashion all using the same DNS namespace. 9

Slide 10

Slide 10 text

Domain â–¸ The domain is a logical structure of containers and objects within Active Directory. A domain contains the following components: â–¹ A hierarchical structure for users, groups, computers and other objects â–¹ Security services that provide authentication and authorization to resources in the domain and other domains â–¹ Policies that are applied to users and computers â–¹ A DNS name to identify the domain. When you log into a computer that is part of a domain you are logging into the DNS domain name. 10

Slide 11

Slide 11 text

Schema â–¸ The Active Directory schema defines every object class that can be created and used in an Active Directory forest. It also defines every attribute that can exist in an object. In other words, it is a blueprint of how data can be stored in Active Directory. 11

Slide 12

Slide 12 text

Object â–¸ Objects are defined as a group of attributes that represent a resource in the domain. These objects are assigned a unique security identifier (SID) that is used to grant or deny the object access to resources in the domain. 12

Slide 13

Slide 13 text

Organizational Units (OUs) â–¸ An OU is a container object that can contain different objects from the same domain. You will use OUs to store and organize, user accounts, contacts, computers, and groups. You will also link group policy objects to an OU. 13

Slide 14

Slide 14 text

Groups â–¸ There are two types of objects, a Security group, and a distribution group. A security group is a grouping of users accounts that can be used to provide access to resources. Distribution groups are used for email distribution lists. 14

Slide 15

Slide 15 text

Users â–¸ A domain user is one whose username and password are stored on a domain controller rather than the computer the user is logging into. â–¸ User accounts are used to gain access to the domain resources. 15

Slide 16

Slide 16 text

Computer â–¸ Each domain-joined computer has an account in AD DS. Computer accounts are used in the same ways that user accounts are used for users. Each computer has a Security Identification (SID) and attributes. when you create a domain, a Computers container is created. 16

Slide 17

Slide 17 text

Sites â–¸ A site is a collection of subnets. The Active Directory sites help define the replication flow and resource location for clients such as a domain controller. 17

Slide 18

Slide 18 text

Global Catalog (GC) â–¸ The global catalog server contains a full replica of all objects and is used to perform forest wide searches. By default the first domain controller in a domain is designated as the GC server. 18

Slide 19

Slide 19 text

Group Policy â–¸ Group policy allows you to centrally manage user and computer settings. You can use group policy to set password policies, auditing policies, lock screen, map drives, deploy software, one drive, office 365 settings and much more. 19

Slide 20

Slide 20 text

Domain Trust â–¸ In an AD environment, trust is a relationship between two domains or forests which allows users of one domain or forest to access resources in the other domain or forest. â–¸ Trust can be automatic (parent-child, same forest etc.) or established (forest, external). â–¸ Trusted Domain Objects (TDOs) represent the trust relationships in a domain. 20

Slide 21

Slide 21 text

Domain Trust â–¸ In an AD environment, trust is a relationship between two domains or forests which allows users of one domain or forest to access resources in the other domain or forest. â–¸ Trust can be automatic (parent-child, same forest etc.) or established (forest, external). â–¸ Trusted Domain Objects (TDOs) represent the trust relationships in a domain. 21

Slide 22

Slide 22 text

Domain Trust ▸ Trust Direction ▹ One-way trust – Unidirectional. Users in the trusted domain can access resources in the trusting domain but the reverse is not true. ▹ Two-way trust – Bi-directional. Users of both domains can access resources in the other domain. 22

Slide 23

Slide 23 text

Domain Trust ▸ Trust Direction ▹ One-way trust – Unidirectional. Users in the trusted domain can access resources in the trusting domain but the reverse is not true. ▹ Two-way trust – Bi-directional. Users of both domains can access resources in the other domain. 23

Slide 24

Slide 24 text

Domain Trust 24 rtlabs.local techno.local Trust Relationship One-way trust Direction of Trust Direction of Access

Slide 25

Slide 25 text

Domain Trust 25 rtlabs.local techno.local Trust Relationship Two-way trust

Slide 26

Slide 26 text

Domain Trust ▸ Trust Transitivity ▹ Transitive – Can be extended to establish trust relationships with other domains. All the default intra-forest trust relationships (Tree-root, ParentChild) between domains within a same forest are transitive two-way trusts. ▹ Nontransitive – Cannot be extended to other domains in the forest. Can be two-way or one-way. This is the default trust (called external trust) between two domains in different forests when forests do not have a trust relationship. 26

Slide 27

Slide 27 text

Domain Trust 27 Domain A Transitive Domain C Domain B

Slide 28

Slide 28 text

Domain Trust 28 Domain A Nontransitive Domain C Domain B

Slide 29

Slide 29 text

Domain Trust ▸ Default/Automatic Trusts – ▹ Parent-child trust – It is created automatically between the new domain and the domain that precedes it in the namespace hierarchy, whenever a new domain is added in a tree. For example, sales.rtlabs.local is a child of rtlabs.local. This trust is always two-way transitive. ▹ Tree-root trust – It is created automatically between whenever a new domain tree is added to a forest root. This trust is always two-way transitive. 29

Slide 30

Slide 30 text

Domain Trust 30 Parent-child trust techno.local dev.techno.local sec.techno.local

Slide 31

Slide 31 text

Domain Trust 31 Tree-root trust techno.local dev.techno.local sec.techno.local sec.rtcloud.local aws.sec.rtcloud.local

Slide 32

Slide 32 text

Domain Trust ▸ Shortcut Trusts – Used to reduce access times in complex trust scenarios. Can be one-way or two-way transitive. ▸ External Trusts – Between two domains in different forests when forests do not have a trust relationship. Can be one-way or two-way and is nontransitive. ▸ Forest Trusts – Between forest root domain. Cannot be extended to a third forest (no implicit trust). Can be one-way or two-way and transitive or nontransitive. 32

Slide 33

Slide 33 text

Domain Trust 33 Shortcut Trusts techno.local dev.techno.local sec.techno.local sec.rtcloud.local aws.sec.rtcloud.local

Slide 34

Slide 34 text

Domain Trust 34 External Trusts rtlabs.local sales.rtlabs.local accounts.rtlabs.local sec.techno.local techno.local Two-Way External Trust One-Way External Trust

Slide 35

Slide 35 text

Domain Trust 35 Forest Trusts rtlabs.local techno.local consult.local Forest trust Forest trust

Slide 36

Slide 36 text

Setup Active Directory 36

Slide 37

Slide 37 text

Setup Active Directory 37

Slide 38

Slide 38 text

Setup Active Directory 38

Slide 39

Slide 39 text

Setup Active Directory 39

Slide 40

Slide 40 text

Setup Active Directory 40

Slide 41

Slide 41 text

Setup Active Directory 41

Slide 42

Slide 42 text

Setup Active Directory 42

Slide 43

Slide 43 text

Setup Active Directory 43

Slide 44

Slide 44 text

Setup Active Directory 44

Slide 45

Slide 45 text

Setup Active Directory 45

Slide 46

Slide 46 text

Setup Active Directory 46

Slide 47

Slide 47 text

Setup Active Directory 47

Slide 48

Slide 48 text

Setup Active Directory 48

Slide 49

Slide 49 text

Setup Active Directory 49

Slide 50

Slide 50 text

Setup Active Directory 50

Slide 51

Slide 51 text

Setup Active Directory 51

Slide 52

Slide 52 text

Setup Active Directory 52

Slide 53

Slide 53 text

Setup Active Directory 53

Slide 54

Slide 54 text

Setup Active Directory 54

Slide 55

Slide 55 text

Setup Active Directory 55

Slide 56

Slide 56 text

Setup Active Directory 56

Slide 57

Slide 57 text

Setup Active Directory 57

Slide 58

Slide 58 text

Integrate Client Machine 58

Slide 59

Slide 59 text

Integrate Client Machine 59

Slide 60

Slide 60 text

Integrate Client Machine 60

Slide 61

Slide 61 text

Integrate Client Machine 61

Slide 62

Slide 62 text

Integrate Client Machine 62

Slide 63

Slide 63 text

Integrate Client Machine 63

Slide 64

Slide 64 text

Credits Thanks to @NullMumbai for granting me the privilege to present. 64

Slide 65

Slide 65 text

Reference â–¸ https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server- 2003/cc780036(v=ws.10) â–¸ https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server- 2003/cc773178(v=ws.10) â–¸ https://activedirectorypro.com/glossary/ â–¸ https://adsecurity.org/ 65

Slide 66

Slide 66 text

66 THANKS! Any questions? You can find me at @chiragsavla94