Winning the Game of Active Directory

Winning the Game of Active Directory

Speakers: Brandon Colley, Senior Security Consultant, Trimark Security

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=M-2d3sM3I2o

Overview

In his DEF CON 32 talk, "Winning the Game of Active Directory," Brandon Colley, a Senior Security Consultant at Trimark Security, challenged conventional notions of success in Active Directory (AD) security. Rather than defining victory as an attacker gaining Domain Administrator privileges or a defender merely preventing a single breach, Colley posited that true triumph lies in the continuous maintenance of a secure environment, consistent improvement of its posture, and diligent implementation of necessary safeguards. This talk served as a dual-perspective guide, offering insights into both offensive attack methodologies and robust defensive strategies within AD environments. Colley leveraged the GOAD (Game of Active Directory) lab, a multi-domain environment featuring over 30 out-of-the-box vulnerable configurations, to illustrate common attack paths and demonstrate practical mitigations.

The talk is particularly relevant in today's threat landscape, where Active Directory remains the backbone of identity and access management for countless organizations and a prime target for adversaries. Colley's perspective shifts the focus from reactive incident response to proactive, holistic security management, emphasizing that achieving Domain Admin is merely a "game over" for the immediate attack, not for the ongoing challenge of securing AD. This article will delve into the technical specifics of the vulnerabilities discussed, the tools utilized, and the actionable defensive measures proposed, providing a comprehensive understanding of how to truly "win" the game of Active Directory.

Background

▶ Watch: Introduction and speaker's background (0:00)

Active Directory has been, and continues to be, the central nervous system for identity and access management in most Windows-based enterprise networks. Its pervasive nature and deep integration into business operations make it an indispensable, yet often vulnerable, component of an organization's IT infrastructure. The complexity of AD, combined with years of accumulated misconfigurations, legacy settings, and sometimes inadequate understanding of its security nuances, creates a rich attack surface for adversaries. Attackers frequently target AD to achieve persistence, escalate privileges, and ultimately gain control over an entire domain.

The talk utilized GOAD (Game of Active Directory), a pre-built, multi-domain Active Directory lab environment. Maintained by Mayfly of Orange Cyber Defense, GOAD is specifically designed to simulate real-world vulnerable AD configurations, boasting over 30 different exploitable setups out of the box. Originally created as a training ground for penetration testers to hone their AD attacking skills, GOAD provides a realistic and safe environment to explore attack vectors. Colley adopted this lab to illustrate both offensive techniques and the corresponding defensive strategies, aligning with his philosophy of understanding both sides of the security coin.

Colley framed the discussion around a "character selection screen," categorizing participants into penetration testers (exploiting vulnerabilities), red teamers (testing detections and stealth), defenders (hardening, monitoring, improving posture), and adversaries (who "don't play by the rules anyway"). This gamified approach underscores the dynamic nature of AD security. The core problem Colley addressed is the widespread misconception that "winning" in AD security, from an attacker's perspective, is simply achieving Domain Administrator privileges. While Domain Admin certainly represents "keys to the kingdom" and often signifies "game over" for a specific engagement, Colley challenged this notion, arguing that for both attackers and defenders, the true win is a continuous state: for attackers, it might be persistent exfiltration or methodical persistence; for defenders, it is the ongoing maintenance of a secure environment, continuous improvement, and the implementation of robust safeguards. This paradigm shift highlights the need for a long-term, strategic approach to AD security, moving beyond a reactive, incident-driven mindset.

Key Findings

▶ Watch: Character selection: pen tester, red teamer, defender, adversary (2:50)

Brandon Colley's presentation underscored several critical findings that collectively redefine what it means to "win" in Active Directory security. The overarching finding is that true victory in Active Directory is not a static endpoint, but a continuous process of maintaining a secure environment, implementing safeguards, and relentlessly improving the security posture. This perspective applies equally to attackers seeking persistent control and defenders striving for resilience.

Beyond this foundational philosophy, the talk highlighted specific, prevalent Active Directory misconfigurations and vulnerabilities that attackers commonly exploit:

1. Anonymous Access for Enumeration: A significant misconfiguration allowing unauthenticated network users to query Active Directory for sensitive information, including user lists and potentially credentials stored in public fields. This demonstrates that initial reconnaissance can yield critical data without any prior authentication.
2. Weak DACL Permissions on Critical Objects (GPOs): Improperly configured Discretionary Access Control Lists (DACLs) on Group Policy Objects (GPOs) can grant low-privileged users the ability to modify or take ownership of these powerful objects. Modifying GPOs, especially at the domain root, can lead to widespread compromise and privilege escalation.
3. Vulnerable Certificate Templates: Misconfigured certificate templates within an Active Directory Certificate Services (AD CS) environment can allow standard users to enroll for certificates that grant them elevated privileges, including Domain Administrator rights. This is a sophisticated attack vector that leverages trusted infrastructure for malicious purposes.

These findings collectively illustrate that many critical vulnerabilities stem not from zero-day exploits, but from common misconfigurations and a lack of understanding regarding the complex interactions of AD components. The speaker emphasized that these issues are frequently present in real-world environments and represent "easy wins" for attackers if not properly addressed by defenders.

Technical Deep Dive

▶ Watch: The true way to win the game of Active Directory (4:00)

Colley structured his technical deep dive around a "gameplay" idea, progressing through levels of attack: reconnaissance, enumeration, privilege escalation (priv esc), and ultimately "pwn Active Directory" as the end boss. Each level highlighted a specific vulnerability or misconfiguration and its exploitation, immediately followed by its defensive mitigation.

Level 1: Reconnaissance and Enumeration – Anonymous Access

The first vulnerability demonstrated was anonymous access, a critical misconfiguration that allows an attacker with basic network connectivity to a domain controller to enumerate users and other public information without any authentication.

• Attack Vector: An attacker, knowing only the IP address of a domain controller, can use tools like CrackMapExec.
• crackmapexec ldap <DC_IP> -users
• Impact: This command, when anonymous access is enabled, can return a list of all users in the domain. More critically, it can also expose information stored in publicly readable attributes, such as the description field of user objects. Colley showed an example where a user named "Samuel" had their password explicitly written in their description field, providing a clear initial credential for an attacker.
• Root Cause: This vulnerability typically arises when the Pre-Windows 2000 Compatible Access group at the domain root includes the Everyone group or the Anonymous Logons group. This configuration grants unauthenticated users broad read access to Active Directory objects, which was historically necessary for certain legacy applications but is a significant security risk today.
• Mitigation: The primary defense is to remove the Everyone and Anonymous Logons groups from the Pre-Windows 2000 Compatible Access group. This restricts unauthenticated queries and significantly reduces the initial reconnaissance surface for attackers. Additionally, enforcing strict policies against storing sensitive information, especially passwords, in any Active Directory attribute, public or otherwise, is crucial.

Privilege Escalation via DACL Permissions on GPOs

A more advanced privilege escalation technique discussed involved abusing weak Discretionary Access Control List (DACL) permissions on critical Active Directory objects, specifically Group Policy Objects (GPOs).

• Attack Vector: If a low-privileged user or group has modify permissions or modify ownership rights on a GPO, they can effectively take control of that GPO. The talk highlighted a scenario where a user, like "Sam" from the previous example (if they gained initial access), could leverage such permissions.
• Impact: GPOs are incredibly powerful because they define security settings, deploy software, run startup/shutdown scripts, and manage user environments across an entire domain or specific OUs. An attacker who can modify a GPO can:
• Deploy malicious scripts to all machines affected by that GPO.
• Modify security settings (e.g., disable firewalls, change password policies).
• Add themselves to privileged local groups on targeted machines.
• Create new administrative accounts.
• Ultimately, this can lead to Domain Administrator compromise. The ability to "give himself or anyone else access to modify this GPO" means full control over its effects.
• Mitigation: This requires a rigorous review of DACL permissions on all critical Active Directory objects, especially GPOs and Organizational Units (OUs). Adherence to the principle of least privilege is paramount. Only highly privileged administrators should have modification rights to GPOs, and these permissions should be explicitly defined and regularly audited. Tools like BloodHound or PingCastle can help identify such misconfigurations by mapping potential attack paths.

Privilege Escalation via Vulnerable Certificate Templates

Another sophisticated privilege escalation method discussed involved the exploitation of vulnerable certificate templates within Active Directory Certificate Services (AD CS).

• Attack Vector: The talk noted that "the domain users, it doesn't have to be domain users, it could just be a subset of regular user accounts that could enroll certificates." This points to scenarios where certificate templates are configured with weak security descriptors, allowing non-privileged users to request certificates that contain attributes or extensions granting them elevated privileges. These are often referred to as ESC8 or similar certificate abuse techniques. The "bigger issue is that supply in the request," implying that the certificate template itself allows for malicious attributes to be included or misinterpreted.
• Impact: An attacker can request a specially crafted certificate from the AD CS server using a vulnerable template. This certificate, when presented for authentication (e.g., to a domain controller), can grant the attacker the identity and privileges of a highly privileged account, effectively leading to Domain Administrator compromise.
• Mitigation: Securing AD CS is complex but critical. Key mitigations include:
• Require Manager Approval: For any certificate template that could potentially grant elevated privileges, implement a "manager approval" requirement. This introduces a human gatekeeper to prevent automated abuse.
• Restrict Enrollment Rights: Ensure that only authorized, highly privileged users or groups have enrollment permissions for sensitive certificate templates.
• Review Template Configuration: Scrutinize the configuration of certificate templates, especially their security descriptors, certificate extensions, and application policies, to ensure they do not allow for privilege escalation. Specifically, templates should not allow users to specify arbitrary Subject Alternative Names (SANs) or other attributes that could impersonate privileged accounts.
• Referencing specialized articles and guides on AD CS hardening (which the speaker mentioned linking to) is essential for comprehensive defense.

These technical points highlight that Active Directory security is a multi-layered challenge, requiring defenders to understand not just direct exploits but also the subtle misconfigurations that create opportunities for sophisticated attacks.

Demo / Proof of Concept

▶ Watch: First misconfiguration: anonymous access via CrackMapExec (5:15)

Brandon Colley's presentation integrated demonstrations and proof-of-concept scenarios using the GOAD (Game of Active Directory) lab environment. While the full, interactive demonstrations were part of the live talk, the transcript provides clear descriptions of the attack steps and outcomes, serving as a conceptual walkthrough.

The GOAD lab, a multi-domain environment with over 30 pre-configured vulnerabilities, served as the ideal battleground for these demonstrations. Colley leveraged its realistic setup to showcase how attackers could move from initial network access to domain compromise.

1. Anonymous Access Enumeration: The first practical demonstration involved using CrackMapExec against a domain controller's IP address. Colley showed how, with anonymous access enabled, crackmapexec ldap <DC_IP> -users could successfully enumerate domain users. The crucial part of this demonstration was the discovery of a user named "Samuel" whose password was explicitly stored in the public description field of his Active Directory user object. This immediately provided initial credentials for further access.

1. GPO DACL Modification: Although the exact steps of modifying a GPO were not fully detailed in the provided transcript segment, Colley explained the concept of exploiting weak DACL permissions. He described how a user, having gained some level of access (e.g., using "Samuel's" credentials), could identify and leverage a GPO with misconfigured modify permissions or modify ownership rights. The implication was that by modifying such a GPO, an attacker could introduce malicious settings or scripts that would then be applied to all affected domain computers or users, leading to privilege escalation or widespread compromise. This was presented as a significant threat due to the broad impact of GPOs.

1. Vulnerable Certificate Template Exploitation: The final proof of concept discussed involved the exploitation of vulnerable certificate templates within Active Directory Certificate Services. Colley described how a "vulnerable template existed in the first place" that allowed "a subset of regular user accounts that could enroll certificates." This scenario demonstrated how an attacker, even without high privileges, could request a certificate from the AD CS server that, due to the template's misconfiguration, would grant them elevated domain privileges upon authentication. The attack flow would typically involve requesting such a certificate and then using it to authenticate as a privileged user, effectively achieving Domain Administrator access.

These demonstrations, facilitated by the GOAD lab, allowed Colley to illustrate the practical implications of common AD misconfigurations, bridging the gap between theoretical vulnerabilities and real-world attack techniques. The use of a dedicated, vulnerable lab environment emphasized the hands-on nature of AD security and provided a clear context for both offensive and defensive learning.

Defensive Implications

▶ Watch: Mitigation for anonymous access by removing groups (6:00)

The insights shared by Brandon Colley offer critical guidance for Active Directory defenders looking to harden their environments and proactively counter common attack vectors. The core message is one of continuous vigilance and improvement, moving beyond a reactive stance to one of proactive security posture management.

1. Eliminate Anonymous Access: This is a fundamental step. Defenders must ensure that the Pre-Windows 2000 Compatible Access group at the domain root does not contain the Everyone group or the Anonymous Logons group. This simple configuration change significantly reduces the attack surface by preventing unauthenticated enumeration of users and other Active Directory objects. Regularly audit this group's membership and other permissions at the domain root.

1. Implement Strict Credential Management: The discovery of "Samuel's" password in a description field highlights a critical human and policy failure. Organizations must enforce strict policies against storing any sensitive information, especially credentials, in Active Directory attributes or any other publicly accessible fields. Automated scanning tools can help identify such misconfigurations. This extends to service accounts, which often have their passwords stored insecurely or are never changed.

1. Audit and Secure DACL Permissions on Critical Objects: This is a complex but crucial area. Defenders must regularly audit and enforce the principle of least privilege on all Active Directory objects, particularly:

• Group Policy Objects (GPOs): Ensure that only Domain Administrators or highly trusted, dedicated GPO administrators have WriteProperty, WriteDACL, or WriteOwner permissions on GPOs, especially those linked to the domain root or sensitive OUs. Any non-administrative user with such rights represents a critical privilege escalation path.
• Organizational Units (OUs): Restrict who can create, delete, or modify objects within OUs, especially those containing sensitive accounts or computers.
• Domain Object: The domain object itself has critical permissions that must be tightly controlled.

Tools like BloodHound (from a blue team perspective) or PingCastle can be invaluable for identifying dangerous DACL configurations and potential attack paths.

1. Harden Active Directory Certificate Services (AD CS): AD CS is a common target for advanced persistent threats. Defenders must:

• Review Certificate Template Configurations: Scrutinize all published certificate templates. Ensure that templates allowing for Smartcard Logon or Authentication do not permit low-privileged users to enroll, or to include arbitrary Subject Alternative Names (SANs).
• Implement Manager Approval: For any template that could grant elevated privileges, configure it to require "manager approval" before a certificate is issued. This adds a crucial human review step.
• Restrict Enrollment Permissions: Limit enrollment permissions for sensitive templates to only the specific users or groups that absolutely require them.
• Monitor AD CS Logs: Implement robust logging and monitoring for certificate issuance, revocations, and failed requests to detect suspicious activity.
• Refer to official Microsoft documentation and community hardening guides (e.g., those related to ESC8 and other AD CS attack vectors) for comprehensive mitigation strategies.

1. Embrace Continuous Improvement and Monitoring: Active Directory security is not a one-time project. It requires ongoing effort.

• Consistent Monitoring: Implement Security Information and Event Management (SIEM) solutions to monitor Active Directory logs for anomalous activity, such as unusual privilege escalations, failed authentications, or modifications to critical objects.
• Regular Assessments: Conduct periodic penetration tests and security assessments (both internal and external) to identify new vulnerabilities and misconfigurations.
• Stay Informed: Keep abreast of the latest Active Directory attack techniques and defensive best practices.

By adopting these defensive postures, organizations can significantly reduce their attack surface, improve their detection capabilities, and ultimately "win" the ongoing game of Active Directory security by maintaining a resilient and continuously improving environment.

Key Takeaways

• Redefining "Winning" in AD Security: True victory in Active Directory is not about gaining or preventing a single Domain Admin compromise, but about continuously maintaining a secure environment, implementing robust safeguards, and consistently improving the overall security posture.
• Initial Reconnaissance is Critical: Simple misconfigurations like anonymous access can allow attackers to enumerate users and discover credentials (e.g., passwords in description fields) without any authentication, providing an easy entry point.
• DACL Permissions are a Privilege Escalation Goldmine: Weak Discretionary Access Control List (DACL) permissions on critical Active Directory objects, particularly Group Policy Objects (GPOs), can enable low-privileged users to gain control over widespread system settings and escalate privileges to Domain Admin.
• Active Directory Certificate Services (AD CS) Requires Vigilance: Misconfigured certificate templates within AD CS environments are a powerful and often overlooked vector for privilege escalation, allowing standard users to acquire certificates that grant them high-level domain access.
• Proactive Mitigation is Paramount: Defenders must proactively remove anonymous access, enforce strict credential policies, meticulously audit and secure DACL permissions on all critical AD objects, and rigorously harden AD CS configurations.
• Continuous Monitoring and Improvement: Active Directory security is an ongoing process. Regular security assessments, consistent monitoring of logs, and staying updated on the latest attack and defense techniques are essential for long-term resilience.

About the Speaker(s)

Brandon Colley is a seasoned cybersecurity professional with extensive experience in Active Directory operations and security. He spent approximately 15 years in an operations role, managing Active Directory for multiple different organizations, gaining deep practical insight into its complexities. For the past two and a half years, he has served as a Senior Security Consultant at Trimark Security, where he specializes in helping organizations secure their Microsoft environments. Recently promoted to the Service Lead role for Trimark's Microsoft cloud assessment services, Colley is also the founder of his own company, BNR Consulting. "Winning the Game of Active Directory" marked his first presentation at DEF CON.