{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"Ranljivost Exchange: kako otkriti pove\u0107anje privilegija do administratora domena","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Otkrivena ove godine ranjivost u Exchangeu<\/a><\/noindex> omogu\u0107ava svakom korisniku domene da dobije administratorska prava i kompromituje Active Directory (AD) i druge povezane hostove. Danas \u0107emo objasniti kako ova napad radi i kako ga otkriti. <\/p>\n

\"Ranljivost
\n<\/a><\/noindex>
\n Evo kako radi ovaj napad:<\/b><\/p>\n

    \n
  1. Napada\u010d preuzima ra\u010dun bilo kojeg korisnika domene s aktivnim po\u0161tanskim sandu\u010di\u0107em kako bi se pretplatio na funkciju push obavijesti iz Exchangea.<\/li>\n
  2. Napada\u010d koristi NTLM proslje\u0111ivanje kako bi prevario Exchange poslu\u017eitelj: poslu\u017eitelj Exchange se spaja na ra\u010dunalom kompromitiranog korisnika koriste\u0107i NTLM over HTTP, koji napada\u010d zatim koristi za prolaz kroz postupak provjere autenti\u010dnosti na kontroleru domene putem LDAP s podacima o ra\u010dunu Exchange.<\/li>\n
  3. Kao rezultat, napada\u010d koristi te ovlasti ra\u010duna Exchange za pove\u0107anje vlastitih privilegija. Ovaj posljednji korak mo\u017ee tako\u0111er provesti zlonamjerni administrator koji ve\u0107 ima legitimni pristup kako bi izvr\u0161io potrebnu promjenu prava. Kreiranjem pravila za otkrivanje ove aktivnosti bit \u0107ete za\u0161ti\u0107eni od ovog i sli\u010dnih napada.<\/li>\n<\/ol>\n

    \nKao posljedicu, napada\u010d mo\u017ee, na primjer, pokrenuti DCSync kako bi dobio hashirane lozinke svih korisnika domene. To \u0107e mu omogu\u0107iti provo\u0111enje raznih vrsta napada \u2014 od napada na golden ticket do prijenosa hash.<\/p>\n

    Istra\u017eiva\u010dki tim Varonisa detaljno je analizirao ovaj vektor napada i pripremio vodi\u010d za na\u0161e klijente kako bi ga otkrili i provjerili jesu li ve\u0107 bili kompromitirani.<\/p>\n

    Otkrivanje pove\u0107anja privilegija u domeni<\/b><\/h2>\n

    \nU DatAlert<\/a><\/noindex> kreirajte korisni\u010dko pravilo za pra\u0107enje promjena odre\u0111enih dozvola na objektu. Ono \u0107e se aktivirati kada se dodaju prava i dozvole na zanimljivom objektu u domeni:<\/p>\n

      \n
    1. Unesite naziv pravila<\/li>\n
    2. Postavite kategoriju kao \"Pove\u0107anje privilegija\" <\/li>\n
    3. Odredite vrijednost za tip resursa \"Svi tipovi resursa\" <\/li>\n
    4. Datote\u010dni poslu\u017eitelj = DirectoryServices <\/li>\n
    5. Odredite domenu koja vas zanima, na primjer po imenu <\/li>\n
    6. Dodajte filtar za dodavanje dozvola na objektu AD <\/li>\n
    7. I ne zaboravite ostaviti neozna\u010denu opciju \"Pretra\u017eiti u podre\u0111enim objektima\" <\/li>\n<\/ol>\n

      \n\"Ranljivost
      \n<\/p>\n

      A sada izvje\u0161taj: otkrivanje promjene prava na objektu domene <\/b><\/h2>\n

      \nPromjene dopu\u0161tenja na AD objektu su prili\u010dno rijetka pojava, stoga je potrebno i obvezno istra\u017eiti sve \u0161to je izazvalo ovu upozorenje. Tako\u0111er, bilo bi dobro testirati izgled i sadr\u017eaj izvje\u0161taja prije nego \u0161to se pravilo pusti u akciju.<\/p>\n

      Ovaj izvje\u0161taj \u0107e tako\u0111er prikazati jeste li ve\u0107 bili kompromitirani ovom napadom:<\/p>\n

      \"Ranljivost
      \n
      \nNakon aktivacije pravila, sve ostale doga\u0111aje pove\u0107anja privilegija mo\u017eete istra\u017eivati koriste\u0107i web su\u010delje DatAlert:<\/p>\n

      \"Ranljivost
      \n
      \nNakon postavljanja ovog pravila mo\u0107i \u0107ete pratiti i za\u0161tititi se od ovih i sli\u010dnih tipova ranjivosti sigurnosnog sustava, istra\u017eiti doga\u0111aje s AD objektima i provjeriti jeste li podlo\u017eni ovoj kriti\u010dnoj ranjivosti.
      \n
      Izvor:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivost Exchange: kako otkriti pove\u0107anje privilegija na razinu administratora domene | ProHoster","description":"Otkrivena ranjivost u Exchangeu ove godine omogu\u0107uje bilo kojem korisniku domene pristup.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}