{"id":53879,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/problema-konfidentsialnosti-dannyh-v-active-directory"},"modified":"2020-02-18T14:01:49","modified_gmt":"2020-02-18T11:01:49","slug":"problema-konfidentsialnosti-dannyh-v-active-directory","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","title":{"rendered":"Andmete privaatsuse probleem Active Directory-s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Andmete
\n
\nMa olen tegelenud sissetungitestidega, kasutades PowerView<\/a><\/noindex> ja kasutasin seda teabe hankimiseks kasutajatest Active Directory's (edaspidi AD). Sel ajal keskendusin kasutaja grupiliikmete teabe kogumisele, et seej\u00e4rel liikuda v\u00f5rgu kaudu. Igal juhul sisaldab AD konfidentsiaalset teavet t\u00f6\u00f6tajate kohta, millest osa ei peaks olema kergesti k\u00e4ttesaadav k\u00f5igile organisatsioonis. Tegelikult on Windowsi failis\u00fcsteemides sarnane k\u00fcsimus \u00abEveryone\u00bb<\/a><\/noindex>, mida saavad kasutada nii sise- kui ka v\u00e4lised r\u00fcndajad.<\/p>\n

Aga enne kui r\u00e4\u00e4gime privaatsusprobleemidest ja nende lahendamise viisidest, vaatame andmeid, mida AD-s hoitakse.
\n<\/a><\/noindex><\/p>\n

Active Directory on ettev\u00f5tte Facebook <\/h2>\n

\nAga antud juhul olete juba k\u00f5ikidega s\u00f5braks saanud! V\u00f5ib-olla ei tea te oma kolleegide lemmikfilmidest, raamatutest ja restoranidest, kuid AD sisaldab tundliku kontaktteabe
\nja muid v\u00e4lju, mida saavad kasutada h\u00e4kkerid ja isegi sise-kurjategijad, kellel pole eriti tehnilisi oskusi.<\/p>\n

S\u00fcsteemiadministraatorid tunnevad kindlasti allolevat ekraanipilti. See on Active Directory Users and Computers (ADUC) liides, kus nad loovad ja redigeerivad kasutaja teavet ning m\u00e4\u00e4ravad kasutajad vastavatesse gruppidesse.<\/p>\n

\"Andmete
\n
\nAD sisaldab v\u00e4lju t\u00f6\u00f6taja nime, aadressi ja telefoninumbri kohta, seega sarnaneb see telefoniraamatuga. Kuid seal on palju rohkem! Teistel vahekaartidel on samuti e-posti aadress ja veebiaadress, vahetu juht ning m\u00e4rkmed.<\/p>\n

Kas k\u00f5ik organisatsiooni inimesed peaksid selle teabe n\u00e4gema, eriti OSINT-i ajastul , kui iga uus detail muudab t\u00e4iendava teabe leidmise veelgi lihtsamaks?<\/a><\/noindex>Loomulikult ei! Probleem s\u00fcveneb, kui ettev\u00f5tte tippjuhtide andmed on k\u00f5igile t\u00f6\u00f6tajatele kergesti k\u00e4ttesaadavad.<\/p>\n

PowerView k\u00f5igile<\/p>\n

Siia astub m\u00e4ngu PowerView. See pakub v\u00e4ga mugavat PowerShell'i liidest tagaplaanil olevatele (ja keerukatele) Win32 funktsioonidele, mis p\u00f6\u00f6rduvad AD poole. \u00dches\u00f5naga:<\/h2>\n

\nsee teeb AD v\u00e4ljade hankimise sama lihtsaks kui v\u00e4ga l\u00fchikese k\u00e4skluse sisestamine.
\n\u044d\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u0435\u0439 AD \u0442\u0430\u043a\u0438\u043c \u0436\u0435 \u043f\u0440\u043e\u0441\u0442\u044b\u043c, \u043a\u0430\u043a \u0432\u0432\u043e\u0434 \u043e\u0447\u0435\u043d\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0433\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u043b\u0435\u0442\u0430.<\/p>\n

V\u00f5tame n\u00e4iteks teabe kogumise Cruella Deville'ist, kes on ettev\u00f5tte \u00fcks juhte. Selleks kasutame PowerView k\u00e4sku get-NetUser:<\/p>\n

\"Andmete
\n
\nPowerView'i installimine ei ole t\u00f5sine probleem \u2013 veenduge selles ise lehelt github<\/a><\/noindex>. Ja mis veelgi olulisem, paljude PowerView k\u00e4skude, nagu get-NetUser, t\u00e4itmiseks ei ole teil k\u00f5rgendatud \u00f5igusi vaja. Seega v\u00f5ib motiveeritud, kuid mitte eriti tehniliselt oskuslik t\u00f6\u00f6taja hakata AD-sse uurima ilma suurema vaevata.<\/p>\n

\u00dclaltoodud ekraanipildilt on n\u00e4ha, et siseringi inimene saab kiiresti palju uut teavet Cruella kohta. Kas olete ka m\u00e4rganud, et \u201einfo\u201d v\u00e4ljas avaneb teave isiklike harjumuste ja kasutaja parooli kohta?<\/p>\n

See ei ole teoreetiline t\u00f5en\u00e4osus. K\u00e4t dialoogides teiste pentesteritega<\/a><\/noindex> sain teada, et nad skaneerivad AD-d, et otsida paroole kr\u00fcpteerimata kujul, ja sageli on need katsed, kahjuks, edukad. Nad teavad, et ettev\u00f5tted suhtuvad AD-sse info osas hooletult, ning tavaliselt ei ole nad teadlikud j\u00e4rgmisest teemast \u2013 AD \u00f5igustest.<\/p>\n

Active Directory'l on oma ACL-d<\/h2>\n

\nAD Users and Computers liides v\u00f5imaldab seada \u00f5igusi AD objektidele. AD-s on ACL-d, ja administraatorid saavad l\u00e4bi nende juurdep\u00e4\u00e4su m\u00e4\u00e4rata v\u00f5i keelata. Peate klikkima \"Advanced\" ADUC vaate men\u00fc\u00fcs, ja siis, kui avate kasutaja, n\u00e4ete vahekaarti \"Security\", kus seadistate ACL. <\/p>\n

Minu Cruellaga seotud stsenaariumis ei soovinud ma, et k\u00f5ik autentitud kasutajad n\u00e4eksid tema isiklikku teavet, seega keelasime neile lugemis\u00f5iguse:<\/p>\n

\"Andmete
\n
\nJa n\u00fc\u00fcd n\u00e4eb tavaline kasutaja seda, kui proovib PowerView'st k\u00e4sku Get-NetUser:<\/p>\n

\"Andmete
\n
\nMul \u00f5nnestus varjata kasulikku teavet v\u00e4lismaalaste eest. Olgu p\u00e4\u00e4s selle teabe juurde asjakohastele kasutajatele, l\u00f5in teise ACL, et lubada VIP-grupi liikmetel (Cruella ja tema teiste k\u00f5rgete kolleegide) sellele konfidentsiaalsele teabele juurde p\u00e4\u00e4seda. Teisis\u00f5nu, rakendasin AD \u00f5igusi p\u00f5hineva rollimudeli abil, muutes tundlikud andmed enamiku t\u00f6\u00f6tajate, sealhulgas siseringi inimeste jaoks k\u00e4ttesaamatuks.<\/p>\n

Kuid saate grupiliikme n\u00e4htamatuks teha kasutajate jaoks, seades grupi objekti ACL-d AD-s vastavalt. See aitab privaatsuse ja turvalisuse seisukohalt.<\/p>\n

Oma epiliste testide seeriad<\/a><\/noindex> N\u00e4itasin, kuidas liikuda s\u00fcsteemi kaudu, uurides r\u00fchma liikmesust PowerViews Get-NetGroupMember abil. Minu stsenaariumis piirasin juurdep\u00e4\u00e4su lugemisele teatud grupi liikmesusele. N\u00e4ete k\u00e4su t\u00e4itmise tulemust enne ja p\u00e4rast muudatusi:<\/p>\n

\"Andmete
\n
\nMul \u00f5nnestus varjata Cruella ja Monty Burnsi liikmestaatust VIP-grupis, mis raskendas h\u00e4kkeritel ja siseringi inimestel infrastruktuuri uurimist.<\/p>\n

See postitus oli m\u00f5eldud selleks, et motiveerida teid p\u00f5hjalikumalt uurima AD ja sellega seotud \u00f5igusi. AD on suurep\u00e4rane ressurss, kuid m\u00f5elge, kuidas sooviksite jagada konfidentsiaalset teavet ja isikuandmeid, eriti
\nkui tegemist on teie organisatsiooni juhtkonnaga.
\nOlen tegelenud testimisega.
\n\ud83e\udd47Andmete privaatsuse probleem Active Directory-s | ProHoster \u00a0
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PowerView \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0435\u0433\u043e \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u0445 \u0438\u0437 Active Directory (\u0434\u0430\u043b\u0435\u0435 \u2013 AD). \u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u044f \u0434\u0435\u043b\u0430\u043b \u0430\u043a\u0446\u0435\u043d\u0442 \u043d\u0430 \u0441\u0431\u043e\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0447\u043b\u0435\u043d\u0441\u0442\u0432\u0435 \u0432 \u0433\u0440\u0443\u043f\u043f\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u044d\u0442\u0443 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0447\u0442\u043e\u0431\u044b \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438. \u0412 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, AD \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u0445, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53879","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Andmete privaatsuse probleem Active Directory-s | ProHoster","description":"Olen tegelenud testimisega.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 Active Directory | ProHoster","og:description":"\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53879","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:08:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:08:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53879","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53879"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53879\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53879"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53879"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53879"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}