{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"Vulnerability Exchange: jak wykry\u0107 podwy\u017cszenie uprawnie\u0144 do administratora domeny","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Wykryta w tym roku vulnerability w Exchange<\/a><\/noindex> pozwala dowolnemu u\u017cytkownikowi domeny uzyska\u0107 prawa administratora domeny i skompromitowa\u0107 Active Directory (AD) oraz inne pod\u0142\u0105czone hosty. Dzi\u015b opowiemy, jak dzia\u0142a ten atak i jak go wykry\u0107. <\/p>\n

\"Vulnerability
\n<\/a><\/noindex>
\n Oto jak dzia\u0142a ten atak:<\/b><\/p>\n

    \n
  1. Napastnik przejmuje konto dowolnego u\u017cytkownika domeny z aktywn\u0105 skrzynk\u0105 pocztow\u0105, aby subskrybowa\u0107 funkcj\u0119 powiadomie\u0144 push z Exchange.<\/li>\n
  2. Napastnik wykorzystuje NTLM relay do oszukania serwera Exchange: w rezultacie serwer Exchange \u0142\u0105czy si\u0119 z komputerem skompromitowanego u\u017cytkownika za pomoc\u0105 metody NTLM over HTTP, kt\u00f3r\u0105 napastnik nast\u0119pnie wykorzystuje do przeprowadzenia procedury uwierzytelniania na kontrolerze domeny przez LDAP z danymi konta Exchange.<\/li>\n
  3. W rezultacie napastnik wykorzystuje te uprawnienia konta Exchange do podniesienia swoich przywilej\u00f3w. Ten ostatni krok mo\u017ce by\u0107 r\u00f3wnie\u017c wykonany przez wrogiego administratora, kt\u00f3ry ju\u017c ma legitymacj\u0119 dost\u0119pu, aby dokona\u0107 koniecznej zmiany uprawnie\u0144. Tworz\u0105c regu\u0142\u0119 do wykrywania tej aktywno\u015bci, zapewnisz sobie ochron\u0119 przed tym i podobnymi atakami.<\/li>\n<\/ol>\n

    \nW konsekwencji napastnik mo\u017ce na przyk\u0142ad uruchomi\u0107 DCSync, aby uzyska\u0107 haszowane has\u0142a wszystkich u\u017cytkownik\u00f3w domeny. To pozwoli mu zrealizowa\u0107 r\u00f3\u017cne rodzaje atak\u00f3w \u2014 od atak\u00f3w golden ticket po przekazywanie haszy.<\/p>\n

    Zesp\u00f3\u0142 badawczy Varonis szczeg\u00f3\u0142owo przeanalizowa\u0142 ten wektor ataku i przygotowa\u0142 przewodnik dla naszych klient\u00f3w, aby go wykry\u0107 oraz sprawdzi\u0107, czy ju\u017c zostali skompromitowani.<\/p>\n

    Wykrywanie podniesienia uprawnie\u0144 w domenie<\/b><\/h2>\n

    \nW DatAlert<\/a><\/noindex> utw\u00f3rz regu\u0142\u0119 u\u017cytkownika do \u015bledzenia zmian okre\u015blonych uprawnie\u0144 na obiekcie. B\u0119dzie ona aktywowana przy dodaniu praw i uprawnie\u0144 do interesuj\u0105cego obiektu w domenie:<\/p>\n

      \n
    1. Podaj nazw\u0119 regu\u0142y<\/li>\n
    2. Ustaw kategori\u0119 jako \u201ePodwy\u017cszenie uprawnie\u0144\u201d <\/li>\n
    3. Okre\u015bl warto\u015b\u0107 dla typu zasobu \u201eWszystkie typy zasob\u00f3w\u201d <\/li>\n
    4. Serwer plik\u00f3w = DirectoryServices <\/li>\n
    5. Okre\u015bl interesuj\u0105c\u0105 Ci\u0119 domen\u0119, na przyk\u0142ad wed\u0142ug nazwy <\/li>\n
    6. Dodaj filtr na dodawanie uprawnie\u0144 do obiektu AD <\/li>\n
    7. I nie zapomnij pozostawi\u0107 opcji \u201ePrzeszukuj w obiektach podrz\u0119dnych\u201d niezaznaczonej <\/li>\n<\/ol>\n

      \n\"Vulnerability
      \n<\/p>\n

      A teraz raport: wykrywanie zmiany uprawnie\u0144 na obiekcie domeny <\/b><\/h2>\n

      \nZmiany uprawnie\u0144 obiektu AD s\u0105 do\u015b\u0107 rzadkim zjawiskiem, dlatego wszystko, co wywo\u0142a\u0142o to ostrze\u017cenie, nale\u017cy zbada\u0107. Warto r\u00f3wnie\u017c przetestowa\u0107 wygl\u0105d i zawarto\u015b\u0107 raportu przed jego uruchomieniem.<\/p>\n

      Ten raport poka\u017ce r\u00f3wnie\u017c, czy ju\u017c pad\u0142e\u015b ofiar\u0105 tego ataku:<\/p>\n

      \"Vulnerability
      \n
      \nPo aktywacji regu\u0142y mo\u017cna zbada\u0107 wszystkie inne zdarzenia podnoszenia uprawnie\u0144, korzystaj\u0105c z interfejsu webowego DatAlert:<\/p>\n

      \"Vulnerability
      \n
      \nPo skonfigurowaniu tej regu\u0142y b\u0119dziesz m\u00f3g\u0142 \u015bledzi\u0107 i broni\u0107 si\u0119 przed tymi oraz podobnymi typami luk w systemie zabezpiecze\u0144, bada\u0107 zdarzenia z obiektami us\u0142ug katalogowych AD i sprawdzi\u0107, czy jeste\u015b podatny na t\u0119 krytyczn\u0105 luk\u0119.
      \n
      \u0179r\u00f3d\u0142o:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luka Exchange: jak wykry\u0107 podniesienie uprawnie\u0144 do administratora domeny | ProHoster","description":"Wykryta w tym roku luka w Exchange umo\u017cliwia ka\u017cdemu u\u017cytkownikowi domeny uzyskanie.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/pl\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}