{"id":53879,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/problema-konfidentsialnosti-dannyh-v-active-directory"},"modified":"2020-02-18T14:01:49","modified_gmt":"2020-02-18T11:01:49","slug":"problema-konfidentsialnosti-dannyh-v-active-directory","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","title":{"rendered":"Andmete konfidentsiaalsuse probleem Active Directorys","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Andmete
\n
\nMa tegin sisselasketeste, kasutades PowerView<\/a><\/noindex> ja kasutasin seda, et koguda teavet kasutajate kohta Active Directorys (edaspidi \u2013 AD). Sel ajal keskendusin turvagruppide liikmete teabe kogumisele ja seej\u00e4rel kasutasin seda teavet v\u00f5rgu kaudu navigeerimiseks. Igal juhul sisaldab AD konfidentsiaalset teavet t\u00f6\u00f6tajate kohta, millest osa ei tohiks olla k\u00f5igile organisatsioonis kergesti k\u00e4ttesaadav. Tegelikult on Windowsi failis\u00fcsteemides sarnane probleem \u201eEveryone\u201d<\/a><\/noindex>, mida v\u00f5ivad kasutada nii sisemised kui ka v\u00e4limised r\u00fcndajad.<\/p>\n

Aga enne, kui r\u00e4\u00e4gime konfidentsiaalsuse probleemidest ja nende lahendamisviisidest, vaatame, millist teavet AD-s hoitakse.
\n<\/a><\/noindex><\/p>\n

Active Directory on ettev\u00f5tte Facebook <\/h2>\n

\nKuid sel juhul oled sa juba k\u00f5igiga s\u00f5brunenud! V\u00f5ib-olla ei tea sa oma kolleegide lemmikfilmide, -raamatute ja -restoranide kohta, kuid AD sisaldab tundlikku kontaktteavet.
\nandmed ja muud v\u00e4ljad, mida v\u00f5ivad kasutada h\u00e4kkerid ja isegi koost\u00f6\u00f6partnerid, kellel pole erilisi tehnilisi oskusi.<\/p>\n

S\u00fcsteemiadministraatorid tunnevad kindlasti allolevat ekraanipilti. See on Active Directory Users and Computers (ADUC) liides, kus nad seadistavad ja redigeerivad kasutajate teavet ning m\u00e4\u00e4ravad kasutajad vastavatesse gruppidesse.<\/p>\n

\"Andmete
\n
\nAD sisaldab t\u00f6\u00f6taja nime, aadressi ja telefoninumbri v\u00e4lju, mist\u00f5ttu see sarnaneb telefoniraamatuga. Kuid seal on veel palju enamat! Teistel vahekaartidel on ka e-posti aadress ja veebiaadress, vahetu \u00fclem ja m\u00e4rkmed.<\/p>\n

Kas kogu organisatsioon peaks n\u00e4gema seda teavet, eriti OSINT ajastul, OSINT<\/a><\/noindex>, kus iga uus detail muudab t\u00e4iendava teabe otsimise veelgi lihtsamaks?<\/p>\n

Muidugi, mitte! Probleem s\u00fcveneb, kui ettev\u00f5tte tippjuhtide andmed on k\u00f5igi t\u00f6\u00f6tajate jaoks kergesti k\u00e4ttesaadavad.<\/p>\n

PowerView on k\u00f5igile<\/h2>\n

\nSiia tuleb m\u00e4ngu PowerView. See pakub v\u00e4ga kasutajas\u00f5bralikku PowerShelli liidest aluseks olevatele (ja segastele) Win32 funktsioonidele, mis p\u00f6\u00f6rduvad AD poole. L\u00fchidalt \u00f6eldes:
\nsee teeb AD-v\u00e4ljade hankimise sama lihtsaks nagu v\u00e4ga l\u00fchikese k\u00e4skluse sisestamine.<\/p>\n

V\u00f5tame n\u00e4iteks teabe kogumise t\u00f6\u00f6taja Cruella Deville'i kohta, kes on \u00fcks ettev\u00f5tte juhtidest. Kasutame selleks PowerView k\u00e4sklust get-NetUser:<\/p>\n

\"Andmete
\n
\nPowerView seadistamine ei ole t\u00f5sine probleem \u2013 veenduge selles ise lehelt github<\/a><\/noindex>. Ja mis veelgi olulisem, paljude PowerView k\u00e4skluste, nagu get-NetUser, t\u00e4itmiseks ei ole teil vajalik k\u00f5rgendatud \u00f5igusi. Seega v\u00f5ib motiveeritud, kuid mitte v\u00e4ga tehniliselt osav t\u00f6\u00f6taja alustada AD-s kaevamist ilma eriliste pingutusteta.<\/p>\n

\u00dclaltoodud ekraanipildilt on n\u00e4ha, et siseauditeerija v\u00f5ib kiiresti saada palju uut teavet Cruella kohta. Kas olete ka m\u00e4rganud, et v\u00e4ljale \u201einfo\u201d ilmub teave kasutaja isiklike harjumuste ja parooli kohta?<\/p>\n

See ei ole teoreetiline t\u00f5en\u00e4osus. R\u00e4\u00e4kides teiste pentestijatega<\/a><\/noindex> uurisin, et nad skannivad AD-d paroolide leidmiseks, mis ei ole kr\u00fcpteeritud, ja sageli on need katsed kahjuks edukaid. Nad teavad, et ettev\u00f5tted suhtuvad AD teabesse hoolimatult ja \u00fcldjuhul ei tea j\u00e4rgmistest teemadest \u2013 \u00f5igustest AD-s.<\/p>\n

Active Directoryl on oma ACL<\/h2>\n

\nAD Users and Computers liides v\u00f5imaldab m\u00e4\u00e4rata \u00f5igusi AD objektidele. AD-s on olemas ACL, ja administraatorid saavad neile juurdep\u00e4\u00e4su m\u00e4\u00e4rata v\u00f5i keelata. Peate men\u00fc\u00fcs ADUC View klikkima \u201eAdvanced\u201d, ja siis, kui avate kasutaja, n\u00e4ete vahekaarti \u201eSecurity\u201d, kus saate ACL-i seadistada. <\/p>\n

Minu Cruella stsenaariumis ei soovinud ma, et k\u00f5ik autentitud kasutajad saaksid n\u00e4ha tema isiklikku teavet, seega keelasime nende lugemis\u00f5iguse:<\/p>\n

\"Andmete
\n
\nJa n\u00fc\u00fcd n\u00e4eb tavaline kasutaja seda, kui proovib PowerView's Get-NetUser:<\/p>\n

\"Andmete
\n
\nSain enesele hiljemalt kasuliku teabe peidetud. Relevantsete kasutajate juurdep\u00e4\u00e4su s\u00e4ilitamiseks l\u00f5in teise ACL, et lubada VIP-grupi liikmetel (Cruella ja teised tema k\u00f5rgemad kolleegid) p\u00e4\u00e4seda nendele konfidentsiaalsetele andmetele. Teiste s\u00f5nadega, rakendasin AD \u00f5igusi, mis p\u00f5hinevad rollimudelil, mis tegi tundlikud andmed enamiku t\u00f6\u00f6tajate, sealhulgas siseringi liikmete jaoks k\u00e4ttesaamatuks.<\/p>\n

Siiski saate grupi liikmelisuse kasutajatele n\u00e4htamatuks teha, kui m\u00e4\u00e4rate grupi objekti ACL-i AD-s vastavalt. See aitab privaatsuse ja turvalisuse osas.<\/p>\n

Oma epiliste pentestide seerias<\/a><\/noindex> n\u00e4itasin, kuidas s\u00fcsteemis ringi liikuda, uurides grupiliikmeid PowerView'i Get-NetGroupMember abil. Oma stsenaariumis piirasin lugemis\u00f5igust konkreetse grupi liikmelisusele. N\u00e4ete k\u00e4skluse t\u00e4itmise tulemusi enne ja p\u00e4rast muudatusi:<\/p>\n

\"Andmete
\n
\nMulle \u00f5nnestus varjata Cruella ja Monty Burnsi liikmelisust VIP-grupis, mis muudab h\u00e4kkerite ja siseringi inimestele infrastruktuuri uurimise keerulisemaks.<\/p>\n

See postitus pidi motiveerima teid t\u00e4helepanelikumalt vaatama AD v\u00e4lju ja sellega seotud \u00f5igusi. AD on suurep\u00e4rane ressurss, kuid m\u00f5elge, kuidas sooviksite jagada konfidentsiaalset teavet ja isikuandmeid, eriti kui tegemist on teie organisatsiooni juhtfiguuridega.
\nAD \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0438\u043c\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f. AD \u2014 \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043d\u043e \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435, \u043a\u0430\u043a \u0431\u044b \u0432\u044b
\n\u0445\u043e\u0442\u0435\u043b\u0438 \u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u0438 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e,
\n\u043a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043f\u0435\u0440\u0432\u044b\u0445 \u043b\u0438\u0446\u0430\u0445 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u00a0
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PowerView \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0435\u0433\u043e \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u0445 \u0438\u0437 Active Directory (\u0434\u0430\u043b\u0435\u0435 \u2013 AD). \u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u044f \u0434\u0435\u043b\u0430\u043b \u0430\u043a\u0446\u0435\u043d\u0442 \u043d\u0430 \u0441\u0431\u043e\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0447\u043b\u0435\u043d\u0441\u0442\u0432\u0435 \u0432 \u0433\u0440\u0443\u043f\u043f\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u044d\u0442\u0443 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0447\u0442\u043e\u0431\u044b \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438. \u0412 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, AD \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u0445, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53879","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Andmete privaatsuse probleem Active Directory's | ProHoster","description":"Olen teinud testimisi sissevoolu osas PowerView abil ja kasutanud seda teabe kogumiseks kasutajatelt Active Directory's (edaspidi AD). Sel ajal keskendusin grupi liikmelisuse teabe kogumisele ja kasutasin seda teavet v\u00f5rgu kaudu liikumiseks. Igal juhul sisaldab AD konfidentsiaalset teavet t\u00f6\u00f6tajate kohta, m\u00f5ned","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 Active Directory | ProHoster","og:description":"\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PowerView \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0435\u0433\u043e \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u0445 \u0438\u0437 Active Directory (\u0434\u0430\u043b\u0435\u0435 \u2013 AD). \u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u044f \u0434\u0435\u043b\u0430\u043b \u0430\u043a\u0446\u0435\u043d\u0442 \u043d\u0430 \u0441\u0431\u043e\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0447\u043b\u0435\u043d\u0441\u0442\u0432\u0435 \u0432 \u0433\u0440\u0443\u043f\u043f\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u044d\u0442\u0443 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0447\u0442\u043e\u0431\u044b \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438. \u0412 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, AD \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u0445, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53879","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:08:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:08:21"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53879","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53879"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53879\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53879"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53879"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53879"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}