{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"Exchange'i haavatavus: kuidas tuvastada \u00f5iguste t\u00f5usu domeeni administraatoriks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sel aastal avastatud haavatavus Exchange'is<\/a><\/noindex> lubab igal domeeni kasutajal saada domeeni administraatori \u00f5igused ja kompromiteerida Active Directory (AD) ning teised \u00fchendatud hostid. T\u00e4na r\u00e4\u00e4gime, kuidas see r\u00fcnnak t\u00f6\u00f6tab ja kuidas seda tuvastada. <\/p>\n

\"Exchange'i
\n<\/a><\/noindex>
\n Nii see r\u00fcnnak t\u00f6\u00f6tab:<\/b><\/p>\n

    \n
  1. Kurjategija omandab aktiivse postkasti olemasoleva domeeni kasutaja konto, et liituda Exchange'i push-teavituste funktsiooniga.<\/li>\n
  2. Kurjategija kasutab NTLM relay't Exchange'i serveri petmiseks: selle tulemusena \u00fchendub Exchange'i server kompromiteeritud kasutaja arvutiga NTLM \u00fcle HTTP meetodi kaudu, mida kurjategija kasutab seej\u00e4rel domeeni kontrolleri autentimisprotseduuri l\u00e4bimiseks LDAP meetodil Exchange'i konto andmetega.<\/li>\n
  3. L\u00f5puks kasutab kurjategija neid Exchange'i konto \u00f5igusi oma privileegide suurendamiseks. See viimase etapi v\u00f5ib teostada ka vaenulikult seadistatud administraator, kellel on juba \u00f5iguslik juurdep\u00e4\u00e4s, et teha vajalikud \u00f5iguse muudatused. Luues reegli selle tegevuse tuvastamiseks, kaitsete end selle ja sarnaste r\u00fcnnakute eest.<\/li>\n<\/ol>\n

    \nSeej\u00e4rel v\u00f5ib kurjategija n\u00e4iteks k\u00e4ivitada DCSync, et saada k\u00f5igi domeeni kasutajate r\u00e4si. See v\u00f5imaldab tal ellu viia erinevaid r\u00fcnnaku t\u00fc\u00fcpe \u2014 alates golden ticket r\u00fcnnakutest kuni r\u00e4si edastamiseni.<\/p>\n

    Varonise uurimismeeskond uuris seda r\u00fcnnakute vektorit \u00fcksikasjalikult ja koostas meie klientidele juhendi selle tuvastamiseks ja kontrollimiseks, kas nad on juba kompromiteeritud.<\/p>\n

    Domeeni privileegide t\u00f5usu tuvastamine<\/b><\/h2>\n

    \nUues DatAlert<\/a><\/noindex> looda kohandatud reegli, et j\u00e4lgida teatud objektide \u00f5iguste muutusi. See aktiveerub, kui domeenis huvitatud objektile lisatakse \u00f5igusi ja volitusi:<\/p>\n

      \n
    1. M\u00e4\u00e4rake reegli nimi<\/li>\n
    2. M\u00e4\u00e4rake kategooria kui \u201ePrivilegeerimise t\u00f5us\u201c <\/li>\n
    3. M\u00e4\u00e4rake ressursi t\u00fc\u00fcbiks \u201eK\u00f5ik ressursit\u00fc\u00fcbid\u201c <\/li>\n
    4. Failiserver = DirectoryServices <\/li>\n
    5. M\u00e4\u00e4rake domeen, mis teid huvitab, n\u00e4iteks nime j\u00e4rgi <\/li>\n
    6. Lisage filter \u00f5iguste lisamise jaoks AD objektile <\/li>\n
    7. Ja \u00e4rge unustage j\u00e4tta valik \u201eOtsi alamobjektides\u201c m\u00e4rkimata <\/li>\n<\/ol>\n

      \n\"Exchange'i
      \n<\/p>\n

      Ja n\u00fc\u00fcd aruanne: domeeni objekti \u00f5iguste muutumise tuvastamine <\/b><\/h2>\n

      \nAD objekti \u00f5iguste muutmine on \u00fcsna haruldane n\u00e4htus, seega tuleb k\u00f5ik, mis selle hoiatuseni viis, uurida. Samuti oleks m\u00f5istlik testida aruande v\u00e4limust ja sisu enne reegli k\u00e4iku laskmist.<\/p>\n

      See aruanne n\u00e4itab ka, kas teid on juba selle r\u00fcnnaku poolt ohustatud:<\/p>\n

      \"Exchange'i
      \n
      \nReegli aktiveerimisel saab uurida k\u00f5iki \u00fclej\u00e4\u00e4nud privileegide t\u00f5usu juhtumeid, kasutades DatAlerti veebi liidest:<\/p>\n

      \"Exchange'i
      \n
      \nSelle reegli seadistamise j\u00e4rel saate j\u00e4lgida ja kaitsta end selliste ja sarnaste s\u00fcsteemi turbehaavatavuste eest, uurida juhtumeid AD katalooge puudutavate objektidega ning kontrollida, kas olete selle kriitilise haavatavuse suhtes vastuv\u00f5tlik.
      \n
      Allikas:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Exchange'i haavatavus: kuidas avastada privilgeeride t\u00f5usu domeeni adminstratoriks | ProHoster","description":"Sellel aastal avastatud haavatavus Exchange'is v\u00f5imaldab igal domeeni kasutajal saada.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}