{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"S\u00e5rbarhed i Exchange: S\u00e5dan opdagers forh\u00f8jelse af privilegier til dom\u00e6neadministrator","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Opdaget i \u00e5r s\u00e5rbarhed i Exchange<\/a><\/noindex> giver enhver dom\u00e6nebruger mulighed for at opn\u00e5 dom\u00e6neadministratorrettigheder og kompromittere Active Directory (AD) samt andre tilsluttede v\u00e6rter. I dag vil vi forklare, hvordan denne angreb fungerer, og hvordan man kan opdage det. <\/p>\n

\"S\u00e5rbarhed
\n<\/a><\/noindex>
\n S\u00e5dan fungerer denne angreb:<\/b><\/p>\n

    \n
  1. Angriberen overtager en konto fra enhver dom\u00e6nebruger med en aktiv mailboks for at abonnere p\u00e5 push-beskedfunktionen fra Exchange.<\/li>\n
  2. Angriberen bruger NTLM relay til at narre Exchange-serveren: dette f\u00e5r Exchange-serveren til at oprette forbindelse til den kompromitterede brugers computer via NTLM over HTTP, som angriberen derefter bruger til at gennemf\u00f8re autentificeringsproceduren p\u00e5 dom\u00e6nekontrolleren via LDAP med oplysningerne fra Exchange-kontoen.<\/li>\n
  3. Som et resultat bruger angriberen disse tilladelser fra Exchange-kontoen til at h\u00e6ve sine privilegier. Dette sidste trin kan ogs\u00e5 udf\u00f8res af en ondsindet konfigureret administrator, der allerede har legitim adgang til at foretage den n\u00f8dvendige \u00e6ndring af rettigheder. Ved at oprette en regel for at opdage denne aktivitet vil du v\u00e6re beskyttet mod denne og lignende angreb.<\/li>\n<\/ol>\n

    \nSom f\u00f8lge heraf kan angriberen for eksempel k\u00f8re DCSync for at f\u00e5 de hashede adgangskoder for alle dom\u00e6nebrugere. Dette vil give ham mulighed for at udf\u00f8re forskellige typer angreb - fra golden ticket angreb til hashoverf\u00f8rsel.<\/p>\n

    Forskningsteamet fra Varonis har grundigt unders\u00f8gt denne angrebsvektor og forberedt en vejledning til vores kunder for at opdage den og samtidig kontrollere, om de allerede er blevet kompromitteret.<\/p>\n

    Opdagelse af privilegiedannelse i dom\u00e6net<\/b><\/h2>\n

    \nI DatAlert<\/a><\/noindex> opret en brugerdefineret regel for at spore \u00e6ndringer i bestemte tilladelser p\u00e5 objektet. Den vil blive aktiveret ved tilf\u00f8jelse af rettigheder og tilladelser til det interessante objekt i dom\u00e6net:<\/p>\n

      \n
    1. Angiv reglenavn<\/li>\n
    2. Indstil kategorien til \"Privilegieh\u00e6vning\" <\/li>\n
    3. Angiv v\u00e6rdien for typen af ressource \"Alle typer ressourcer\" <\/li>\n
    4. Filserver = DirectoryServices <\/li>\n
    5. Angiv det dom\u00e6ne, du er interesseret i, for eksempel efter navn <\/li>\n
    6. Tilf\u00f8j et filter til tilf\u00f8jelse af tilladelser p\u00e5 AD-objektet <\/li>\n
    7. Og glem ikke at lade indstillingen \"S\u00f8g i underobjekter\" v\u00e6re umarkeret <\/li>\n<\/ol>\n

      \n\"S\u00e5rbarhed
      \n<\/p>\n

      Og nu rapporten: opdagelse af \u00e6ndring af rettigheder p\u00e5 dom\u00e6neobjekt <\/b><\/h2>\n

      \n\u00c6ndringer af AD-objektets tilladelser er en ret sj\u00e6lden h\u00e6ndelse, s\u00e5 alt, hvad der har for\u00e5rsaget denne advarsel, skal unders\u00f8ges. Det vil ogs\u00e5 v\u00e6re en god id\u00e9 at teste rapportens udseende og indhold, inden reglen g\u00e5r i drift.<\/p>\n

      Denne rapport vil ogs\u00e5 vise, om du allerede er blevet kompromitteret af dette angreb:<\/p>\n

      \"S\u00e5rbarhed
      \n
      \nEfter aktivering af reglen kan du unders\u00f8ge alle andre h\u00e6ndelser med forh\u00f8jede privilegier ved hj\u00e6lp af DatAlert-webgr\u00e6nsefladen:<\/p>\n

      \"S\u00e5rbarhed
      \n
      \nN\u00e5r du har konfigureret denne regel, vil du kunne overv\u00e5ge og beskytte dig mod disse og lignende typer af sikkerhedsbrister, unders\u00f8ge h\u00e6ndelser med AD-katalogtjenesteobjekter og kontrollere, om du er s\u00e5rbar over for denne kritiske s\u00e5rbarhed.
      \n
      Kilde:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Exchange-s\u00e5rbarhed: hvordan man opdager forh\u00f8jelse af privilegier til dom\u00e6neadministrator | ProHoster","description":"Den s\u00e5rbarhed, der blev opdaget i \u00e5r i Exchange, giver enhver dom\u00e6nebruger adgang.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}