Active Directory (AD)

A directory architecture for Windows network environments.

It is distributed hierarchical structure that allows for centralised management of an organisation’s resources, including:

• Users
• Computers
• Groups
• Network devices
• File shares
• Group policies
• Devices
• Trusts

It is hosted and implemented by Domain Controllers (DCs) running Active Directory Domain Services (AD DS), which also runs authentication and authorisation functions within the AD architecture.

Cause for attacks

It is not secure by default and is prone to misconfigurations.

It can be seen as a read-only database accessible for all users within the Domain, regardless of their privilege level. This means that any user can be used to enumerate the domain and hunt for configurations, making it an attractive to attacks.

Structure

It has a hierarchical structure as follows:

1. Forest
2. Tree
3. Domains
4. Organisational Units (OUs) or leaf Objects

Trusts between the domains of the forest can be either bidirectional or one-directional, which determine whether a user of on domain can authorise users of the other domain.

Known Attacks

• PrintNightmare
• Shadow Credentials
• noPac
• ZeroLogon
• Kerberoasting
• DCShadow
• ASREPRoast
• ACE up the sleeve

Protocols

• Kerberos for authentication
• Lightweight Directory Access Protocol (LDAP) for querying and updating the directory. Can also be used for authentication.
• Domain Name System (DNS) for locating Domain Controllers (DCs).
• Microsoft Remote Procedure Call (MSRPC) for the RPC interfaces:
  • lsarpc
  • netlogon
  • samr
  • drsuapi

Hash Protocols

• NTLM
• NTLMv1
• NTLMv2
• Kerberos

Examples

Structure

  INLANEFREIGHT.LOCAL/
├── ADMIN.INLANEFREIGHT.LOCAL
│   ├── GPOs
│   └── OU
│       └── EMPLOYEES
│           ├── COMPUTERS
│           │   └── FILE01
│           ├── GROUPS
│           │   └── HQ Staff
│           └── USERS
│               └── barbara.jones
├── CORP.INLANEFREIGHT.LOCAL
└── DEV.INLANEFREIGHT.LOCAL