Fortifying Active Directory: Combatting Misconfigurations

Fortifying Active Directory: Combatting Misconfigurations

Speakers: Jeff Tomkiewicz, Offensive Security Engineer, Humana

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=B8qaH6rQVQM

Overview

In his BSides NYC presentation, "Fortifying Active Directory: Combatting Misconfigurations," Jeff Tomkiewicz delves into the pervasive and often overlooked security vulnerabilities stemming from common misconfigurations within Active Directory (AD) environments. Drawing heavily from a joint advisory released by CISA and NSA, which identified the top 10 most common network misconfigurations observed during extensive red and blue team assessments, Tomkiewicz provides a red teamer's perspective on how these flaws are exploited and, crucially, how defenders can fortify their systems. The talk serves as a critical wake-up call, highlighting that many fundamental security issues persist even within organizations that consider themselves "mature."

Tomkiewicz, an offensive security engineer with a background in military intelligence and physical covert entry, shares insights from his "epic journey" into understanding both the attack and defense sides of Active Directory. He emphasizes that AD, whether in its traditional form or evolving into services like Azure Active Directory (now Microsoft Entra ID), remains the backbone of most large organizations and is "never gonna go away." This talk is highly relevant for system administrators, security architects, red teamers, and blue teamers alike, offering practical advice and a candid assessment of the current state of enterprise security postures against well-known, yet frequently unaddressed, weaknesses.

The core message resonates with the idea that while attackers constantly seek novel exploits, many successful breaches leverage basic misconfigurations that have been known for years. By systematically addressing these foundational issues, organizations can significantly enhance their defensive capabilities and reduce their attack surface. Tomkiewicz's presentation bridges the gap between offensive tactics and defensive strategies, making complex Active Directory security concepts accessible and actionable for a broad audience.

Background

▶ Watch: Introduction and overview of CISA/NSA advisory (0:00)

The genesis of this talk lies in a joint advisory released in October 2023 by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA). This advisory detailed the top 10 most common network misconfigurations discovered through a series of joint red and blue team assessments. A unique aspect of these assessments, as highlighted by Tomkiewicz, was an innovative purple teaming approach where red and blue teams swapped roles for three months, learning each other's methodologies before conducting the joint evaluations. This collaborative effort yielded critical insights into systemic weaknesses that transcend traditional team silos.

The CISA/NSA advisory highlighted two significant overarching weaknesses:

1. Systematic weaknesses in large organizations that often consider themselves mature in their security posture. The assessments revealed that even these seemingly robust environments harbored fundamental flaws.
2. The critical need for software manufacturers to bake security in from the start when building products. Tomkiewicz argues that the failure to do so inherently creates problems for defenders, forcing them to retrofit security onto insecure-by-default systems.

Active Directory itself is a cornerstone of enterprise IT infrastructure. As Tomkiewicz notes, "any big organization... uses Active Directory. All your Fortune 500s, it's here to stay." Despite the emergence of cloud-based identity services, the underlying principles and challenges of AD security remain relevant. The problem isn't necessarily a lack of awareness of these misconfigurations, but rather a persistent failure to implement known best practices, often due to human factors like laziness, budget constraints, or a lack of continuous oversight. This talk aims to re-emphasize these fundamental issues and provide actionable guidance for remediation.

Key Findings

▶ Watch: Speaker's background: red team, military, social engineering (3:20)

The talk systematically addresses each of the top 10 misconfigurations identified by the CISA/NSA advisory, detailing the specific findings observed during the assessments:

1. Default Configurations of Software and Applications: Assessment teams frequently encountered insecure Active Directory Certificate Services (ADCS), including a lack of control over who could issue certificates, the use of weak cryptographic algorithms like SHA-1, and improper certificate revocation settings. They also found widespread use of insecure legacy protocols such as SMBv1 and NTLM/LM hashes, alongside numerous open network shares accessible without authentication.
2. Improper Separation of User and Administrative Privileges: This was a critical vulnerability, with assessment teams consistently finding accounts possessing excessive privileges (privilege creep) or the misuse of shared administrative accounts and built-in groups. A pervasive lack of monitoring and auditing allowed these issues to persist. Attackers leveraged these privilege issues to compromise entire domains in under a day on multiple occasions.
3. Insufficient Internal Network Monitoring: A striking finding was the presence of extensive host-based monitoring but a glaring absence of network-level monitoring. This blind spot allowed attackers to establish command and control (C2) channels and move laterally within environments undetected. Even when intentionally creating "noisy" activity, the blue teams often failed to detect the intrusion.
4. Lack of Network Segmentation: Despite organizations claiming robust segmentation, assessments revealed rampant flat networks. Attackers easily discovered forgotten connections or misconfigured routes, allowing them to traverse the network unimpeded and access critical systems that should have been isolated.
5. Poor Patch Management: Organizations frequently ran outdated software vulnerable to well-known exploits. Notable examples included systems vulnerable to EternalBlue (MS17-010), a vulnerability from 2017, and ZeroLogon, a remote code execution flaw that grants domain admin privileges. This lack of patching led directly to exploitation and potential for widespread malware or ransomware.
6. Bypass of System Access Controls: Attackers successfully bypassed various authentication methods. Kerberoasting was identified as the most time-efficient method for privilege escalation, allowing attackers to mimic accounts, expand access, and move freely within internal networks. Other techniques like Pass-the-Hash, Pass-the-Ticket, Golden/Silver Ticket attacks, and DC Shadow attacks were also observed.
7. Weak or Misconfigured Multi-Factor Authentication (MFA): While MFA was often implemented, it was frequently susceptible to social engineering bypasses. Attackers convinced users to provide MFA codes over the phone, or exploited misconfigurations. Tomkiewicz cites real-world examples like the MGM and UnitedHealth breaches where MFA was present but bypassed due to social engineering or incorrect setup.
8. Insufficient Access Control Lists (ACLs) on Network Shares and Services: Assessment teams easily identified and accessed sensitive data on network shares due to poorly configured ACLs. This included personally identifiable information (PII) and even tax returns, which could be exfiltrated and used for extortion or further social engineering.
9. Poor Credential Hygiene: Weak, default, or unchanged passwords were a persistent problem. Credentials were often stored insecurely (e.g., in plaintext on WordPads), and a lack of MFA further exacerbated the risk. In one instance, a red team was able to crack 80% of all user passwords in an Active Directory environment within 12 hours, yielding a wealth of valid credentials.
10. Unrestricted Code Execution: Attackers found numerous opportunities to execute arbitrary code within networks. This included leveraging executables and dynamic link libraries (DLLs) to achieve privileged escalation, enable lateral movement, facilitate data exfiltration, and establish persistent mechanisms for future access.

Technical Deep Dive

▶ Watch: Joint advisory methodology: red and blue team swap roles (4:10)

The talk provides several technical explanations and examples to illustrate the findings. A significant portion of the technical deep dive focuses on Kerberoasting, a technique identified as highly effective for privilege escalation.

Kerberoasting Explained (MoviePass Analogy):

Tomkiewicz simplifies Kerberos, the primary authentication protocol for Active Directory, using a MoviePass analogy.

1. User (Me) wants to access a service (Beetlejuice movie): I can't directly access it.
2. User contacts the Key Distribution Center (KDC) (MoviePass): I prove my identity to the KDC.
3. KDC issues a Ticket Granting Ticket (TGT): This ticket confirms my identity and allows me to request access to services. In the MoviePass analogy, this is like getting a general movie ticket from MoviePass after they verify my account.
4. User presents TGT to the service (Theater for Beetlejuice): I present my TGT to the service I want to access.
5. Service (Theater) requests a Service Ticket from the KDC: The service validates my TGT with the KDC.
6. KDC issues a Ticket Granting Service (TGS) ticket: This TGS ticket is specific to the service I want to access and is encrypted with the service's password hash.
7. Service grants access: The service decrypts the TGS, verifies my authorization, and grants access.

Kerberoasting Attack:

In a Kerberoasting attack, the attacker specifically targets service accounts registered in Active Directory. These accounts have Service Principal Names (SPNs) associated with them, which are essentially unique identifiers for services. When a user requests a TGS for a service, the KDC issues that ticket, encrypted with the service account's NTLM hash. The attacker, posing as a legitimate user, requests a TGS for a service account. They then take this encrypted TGS ticket offline and attempt to crack the NTLM hash of the service account's password using tools like Hashcat or John the Ripper. If successful, they obtain the service account's plaintext password.

Tomkiewicz notes that Kerberoasting is "loud, loud, loud" and should ideally be detected by a mature security operations center (SOC). However, it remains highly effective due to weak service account passwords and insufficient monitoring. He clarifies that while a Silver Ticket attack grants access to a specific service, a Golden Ticket attack (which involves compromising the krbtgt account hash) grants full access to the entire domain, akin to having "the keys to the city."

Administrative Tier Model:

To combat improper privilege separation, Tomkiewicz advocates for the Administrative Tier Model (also known as the Tiered Administration Model). This model segments Active Directory and other critical systems into different security tiers:

• Tier 0: Contains the most sensitive assets, such as domain controllers, identity management systems, and administrative accounts with "Enterprise Admin" or "Domain Admin" privileges. Access to this tier should be extremely restricted.
• Tier 1: Includes servers, applications, and other critical infrastructure. Administrators for this tier should only have privileges relevant to managing these systems.
• Tier 2: Encompasses user workstations and endpoints. Regular users operate within this tier, and their access should be limited to what's necessary for their daily tasks.

This model enforces a strict "no-touch" rule, meaning administrative accounts from a higher tier should never log into or manage resources in a lower tier, preventing privilege escalation through compromised lower-tier systems. Complementary concepts like Just Enough Administration (JEA) and Privileged Access Workstations (PAWs) are crucial for implementing this model effectively. JEA ensures that administrators only have the minimum necessary permissions for specific tasks, while PAWs are hardened, dedicated workstations used solely for administrative duties, isolated from general user networks.

Legacy Protocols and Weak Cryptography:

The continued prevalence of SMBv1 and NTLM/LM hashes in mature organizations is a critical finding. SMBv1 is notoriously insecure and vulnerable to attacks like EternalBlue. NTLM and especially LM hashes are weak authentication protocols that are easily cracked or relayed. The recommendation is to disable SMBv1 entirely and configure Group Policy to prevent the storage of LM hashes. Similarly, the use of SHA-1 for digital certificates is a significant weakness, as SHA-1 is cryptographically broken and vulnerable to collision attacks. Organizations should migrate to stronger algorithms like SHA-256 or higher.

Patch Management Vulnerabilities:

The mention of MS17-010 (EternalBlue) and ZeroLogon highlights the severe consequences of poor patch management. EternalBlue, exploited by WannaCry and NotPetya, allowed for widespread network compromise. ZeroLogon (CVE-2020-1472) allowed an unauthenticated attacker to gain domain administrator privileges with a single network packet. The continued presence of these vulnerabilities underscores a fundamental breakdown in operational security, despite patches being available for years. Tomkiewicz even mentions Shodan as a tool to find systems still vulnerable to EternalBlue, sometimes displaying ransomware screens.

Tools and Techniques for Defense:

Tomkiewicz lists various tools and techniques for defensive posture:

• SIEM/SEM (Security Information and Event Management): Tools like Splunk for collecting, analyzing, and correlating security event data.
• NTA (Network Traffic Analysis) & EDR (Endpoint Detection and Response): For comprehensive monitoring.
• Microsoft Advanced Threat Analytics (ATA) and Azure Advanced Threat Protection (ATP): Microsoft's native solutions for AD security monitoring.
• PowerShell scripts: For auditing Active Directory configurations and permissions.
• Windows Server Update Services (WSUS), Ivanti Patch, and (with caution) SolarWinds: For patch management.
• HashiVault: For secure credential storage.
• VLANs, Subnets, Firewalls, ACLs: Fundamental network segmentation tools.

Demo / Proof of Concept

▶ Watch: First misconfiguration: Default configurations of software and applications (6:15)

The talk does not include a live technical demonstration or proof of concept. Instead, Jeff Tomkiewicz relies on the findings from the CISA/NSA joint advisory assessments and his extensive experience as a red teamer to illustrate the concepts. He describes how these misconfigurations were exploited during real-world assessments, providing concrete examples of the impact of each vulnerability. His anecdotes and explanations serve as descriptive "proofs of concept" derived from actual engagements rather than a live technical demo.

Defensive Implications

▶ Watch: Examples of default configuration issues: credentials, legacy protocols (7:00)

Tomkiewicz provides clear, actionable advice for defenders, emphasizing both technical implementations and process improvements. The overarching themes are proactive security and continuous monitoring.

1. Harden Default Configurations:

• Active Directory Certificate Services (ADCS): Use strong cryptographic algorithms (SHA-256 or higher). Restrict certificate templates to only authorized personnel and purposes. Implement proper certificate revocation mechanisms like Online Certificate Status Protocol (OCSP) or Certificate Revocation Lists (CRLs). Crucially, isolate certificate servers on segmented networks.
• Disable Legacy Protocols: Eliminate SMBv1 and older NTLM/LM hashes. Configure Group Policy to enforce modern, secure SMB versions (2 or 3) and prevent LM hash storage.
• Secure Network Shares: Implement robust Access Control Lists (ACLs) on all network shares, ensuring Principle of Least Privilege (PoLP). Regularly audit share permissions to prevent unauthorized access.

1. Enforce Principle of Least Privilege (PoLP):

• Regular Audits: Continuously audit user and administrative accounts to ensure they possess only the minimum necessary privileges for their job functions. Address privilege creep promptly.
• Role-Based Access Control (RBAC): Implement RBAC to define and assign permissions based on job roles, streamlining management and reducing excessive privileges.
• Administrative Tier Model: Structure your network and administrative accounts into tiers (Tier 0, 1, 2) to isolate critical assets and prevent lateral movement from compromised lower-tier systems.
• Just Enough Administration (JEA) & Privileged Access Workstations (PAWs): Use JEA to grant temporary, task-specific administrative rights and deploy PAWs for sensitive administrative tasks, further isolating these high-privilege activities.

1. Implement Robust Network Monitoring:

• Comprehensive Monitoring: Deploy Security Information and Event Management (SIEM/SEM) solutions (e.g., Splunk), Network Traffic Analysis (NTA) tools, and Endpoint Detection and Response (EDR) systems to achieve full visibility across both hosts and the network.
• Monitor for Indicators of Compromise (IOCs): Actively look for unusual login activity (e.g., 3 AM logins), changes to critical Active Directory groups (e.g., Enterprise Admin additions), suspicious process activity, and unauthorized changes to security settings or Group Policy Objects (GPOs).
• Leverage Native Tools: Utilize Microsoft solutions like Advanced Threat Analytics (ATA) and Azure Advanced Threat Protection (ATP) for AD-specific threat detection.

1. Strengthen Network Segmentation:

• Logical and Physical Separation: Employ VLANs, subnets, firewalls, and ACLs to create logical network segments. Isolate critical systems (like domain controllers, certificate servers, and sensitive data repositories) from general user networks.
• Identify Forgotten Connections: Regularly audit network topology and configurations to identify and remediate any "forgotten connections" or misconfigured routes that could bridge segmented zones.
• Time and Resource Investment: Acknowledge that proper network segmentation, especially in large, mature organizations, requires significant time, money, and skilled personnel. It's a long-term investment.

1. Prioritize Patch Management:

• Automated Patching: Implement centralized patch management solutions like Microsoft Windows Server Update Services (WSUS) or third-party tools (e.g., Ivanti Patch) to ensure timely application of security updates across all systems.
• Validation and Testing: Always test patches in a staging or development environment before deploying them to production. Implement rollback plans for critical updates.
• Security Baselines: Establish and continuously review security baselines and configuration management policies to ensure systems remain hardened against known vulnerabilities.
• User Education & Enforcement: Educate users on the importance of restarting machines for updates and, where necessary, mandate reboots for critical patches.

1. Enhance Authentication and Credential Hygiene:

• Strong Passwords: Enforce strong, unique password policies (minimum length, complexity, no common patterns).
• Multi-Factor Authentication (MFA): Implement MFA across the organization, especially for administrative accounts and critical systems. Crucially, ensure MFA is correctly configured and covers all relevant access paths.
• Social Engineering Training: Conduct regular training for employees on identifying and resisting social engineering attacks, particularly those aimed at bypassing MFA.
• Secure Credential Storage: Use enterprise-grade password managers or secrets management solutions (e.g., HashiVault) to store credentials securely, eliminating insecure practices like plaintext files.
• Regular Audits and Penetration Testing: Conduct frequent credential audits and penetration tests to identify weak passwords, compromised accounts, and vulnerabilities in authentication mechanisms.

1. Restrict Code Execution:

• Group Policy Restrictions: Utilize GPOs to restrict the execution of unauthorized scripts and executables.
• Application Whitelisting: Implement application whitelisting to allow only approved applications to run on systems, preventing the execution of malicious code.
• User Access Control (UAC): Properly configure UAC to mitigate the impact of unauthorized code execution by limiting privileges.
• Security Hardening: Apply comprehensive security hardening guides (e.g., CIS benchmarks) to all endpoints and servers to reduce the attack surface for code execution exploits.

Key Takeaways

• Pervasive Misconfigurations: Even "mature" organizations often suffer from fundamental, long-standing Active Directory misconfigurations, making them vulnerable to well-known attack techniques.
• Proactive & Continuous Monitoring: Active Directory security is not a one-time setup; it requires continuous monitoring, regular audits, and proactive measures to detect and remediate weaknesses.
• Embrace Principle of Least Privilege: Implement and strictly enforce the Principle of Least Privilege (PoLP) across all user and administrative accounts, coupled with the Administrative Tier Model, to minimize the impact of compromise.
• Foundational Security Matters: Robust patch management, network segmentation, and the elimination of legacy protocols (like SMBv1) are non-negotiable foundations for effective defense.
• MFA is Not a Panacea: While crucial, Multi-Factor Authentication (MFA) must be correctly configured and complemented by strong social engineering training to prevent bypasses.
• Red Team Insights for Blue Team Action: Insights from offensive security assessments, especially through purple teaming (red and blue team collaboration), are invaluable for identifying exploitable weaknesses and improving defensive postures.

About the Speaker(s)

Jeff Tomkiewicz is an Offensive Security Engineer at Humana, a Fortune 40 Health and Safety company. In this role, he specializes in various offensive security disciplines, including network penetration testing, Wi-Fi security assessments, and physical covert entry. Notably, he also leads the social engineering service line for his company, demonstrating expertise in human-centric attack vectors. Prior to his career in offensive security, Jeff served over 20 and a half years in the Air Force, where his responsibilities included military police duties and threat intelligence, focusing on "other bad guy stuff" rather than cyber, which provided him with a unique perspective on security and adversaries. His diverse background informs his holistic approach to understanding and fortifying Active Directory environments.