Exploring, Exploiting Active Directory Admin Flaws

Common methods AD administrators use to protect their environments can easily be exploited. Heres how.

No matter how many tools you buy or how many alerts flood the SOC, your security strategy is only as strong as its administration. If attackers can bypass an admin, they can own the system.
Administrator security was the crux of Sean Metcalfs 2018 DEF CON talk, Exploiting Active Directory Administrator Insecurities, during which the Trimarc cofounder and CTO outlined the strategies admins are adopting to protect their environments and the flaws in their approaches.
Metcalf dove into current methods businesses are using to administer Active Directory, inherent weaknesses, and what defenders should be watching for. Examples included using read-only domain controllers in ways the organization doesnt expect, exploiting access to agents installed on domain controllers and other privileged systems, and exploiting AD forests.
His idea was to provide insight for red teamers pentesting against organizations improving their defenses, as well as for blue teamers hoping to improve their Active Directory security.
Years ago, he explained, organizations had many admins and sometimes, user accounts doubled as domain admins. Every local administrator account had the same username and password, and some environments had nearly as many domain admins as they did users.
Old school admin methods, as Metcalf put it, meant logging into a workstation as an admin with credentials stored in Local Security Authority Subsystem Service (LSASS), running standard Microsoft admin tools with credentials in LSASS, and using RDP to log into the domain controller or admin servers for management.
It was a target-rich environment with multiple paths to exploit, he said. Now, admins are using newer methods like multi-factor authentication (MFA) and password vaults to protect their credentials so threat actors cant gain access to their environments.
Sneaking Past MFA
There are a few ways for attackers to subvert MFA and gain Active Directory access, Metcalf explained.
Yes, MFA is good, he said. But there are situations in which MFA can be bypassed depending on how its configured. If an attacker knows how to switch authentication data, for example, they can enter their own phone number and have second-factor codes directly sent to their device without the administrators knowledge.
One of the interesting things about MFA is its onboarding process, he added, using a vendors authentication technology as an example. The tech works by connecting to an API; when someone connects and sees a prompt, it checks to see if that user can access a specific resource.
However, he continued, if a third party could compromise the admin account, they could have influence over that email so they could filter it out and/or add more devices. Metcalf presented a screen showing different integration options during the configuration process. For example, he explained, an attacker could configure an admins authentication so it could be bypassed while the user is offline, and/or uncheck the policy that requires authentication while logging in via RDP.
Metcalf recommended using MFA but advised attendees not to rely on it as the primary method for protecting admin accounts. Use hardware tokens or apps, he said, and disable SMS when possible. Ensure all MFA users know how to report anomalies when they see them.
Remember that once an attacker has AD admin credentials, MFA doesnt really stop them, he noted. He advised correlating users to admin accounts and the workstation used by each admin, in order to make sure the proper person is in place ot be handling admin processes.
Password Vaults
Enterprise password vaults are another tool being deployed more broadly to improve admin security and maintain admin accounts, Metcalf continued. Many businesses include additional components like Session Manager to augment security in addition to the password vault.
He detailed several weaknesses in password vault configuration: authentication to the password vaults Web server is usually done with the admins user account, and connecting to the server doesnt always require MFA. Password vault servers are often administered like any other server and usually permit anyone on the network to send traffic.
Sessions on the server arent always limited, he continued, creating an opportunity for an attacker to create a new session. Combining the password vault Web server and password management system increases risk, and a flaw in the vault can lead to full AD compromise.
Metcalf pointed to vulnerability CVE-2018-9843 as an example. The flaw in the REST API of password vault software could potentially allow remote attackers to execute arbitrary code through a serialized .NET object in an Authorization HTTP header.
Related Content:
6 Eye-Raising Third-Party Breaches
The 5 Challenges of Detecting Fileless Malware Attacks
Active Third-Party Content the Bane of Web Security
Overcoming Security as a Silo with Orchestration and Automation
Learn from the industrys most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for
more info
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Exploring, Exploiting Active Directory Admin Flaws