{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"Vulnerabilidade do Exchange: como detectar a eleva\u00e7\u00e3o de privil\u00e9gios para administrador de dom\u00ednio","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Detectada este ano vulnerabilidade no Exchange<\/a><\/noindex> permite que qualquer usu\u00e1rio do dom\u00ednio obtenha privil\u00e9gios de administrador de dom\u00ednio e comprometa o Active Directory (AD) e outros hosts conectados. Hoje vamos explicar como funciona este ataque e como detect\u00e1-lo. <\/p>\n

\"Vulnerabilidade
\n<\/a><\/noindex>
\n Assim funciona este ataque:<\/b><\/p>\n

    \n
  1. O atacante assume a conta de qualquer usu\u00e1rio do dom\u00ednio com uma caixa de entrada ativa para assinar a fun\u00e7\u00e3o de notifica\u00e7\u00f5es push do Exchange<\/li>\n
  2. O atacante usa o NTLM relay para enganar o servidor Exchange: o servidor Exchange, portanto, se conecta ao computador do usu\u00e1rio comprometido usando o m\u00e9todo NTLM over HTTP, que o atacante ent\u00e3o utiliza para passar pelo processo de autentica\u00e7\u00e3o no controlador de dom\u00ednio via LDAP com os dados da conta do Exchange.<\/li>\n
  3. Como resultado, o atacante usa esses privil\u00e9gios da conta do Exchange para elevar suas permiss\u00f5es. Esta \u00faltima etapa tamb\u00e9m pode ser realizada por um administrador mal-intencionado que j\u00e1 tenha acesso leg\u00edtimo para fazer a altera\u00e7\u00e3o necess\u00e1ria nas permiss\u00f5es. Criando uma regra para detectar esta atividade, voc\u00ea estar\u00e1 protegido contra este e outros ataques semelhantes.<\/li>\n<\/ol>\n

    \nPosteriormente, o atacante pode, por exemplo, executar DCSync para obter os hashes de senha de todos os usu\u00e1rios do dom\u00ednio. Isso permitir\u00e1 que ele realize v\u00e1rios tipos de ataques \u2014 desde ataques de golden ticket at\u00e9 pass-through de hashes.<\/p>\n

    A equipe de pesquisa da Varonis examinou detalhadamente este vetor de ataque e elaborou um guia para nossos clientes para detect\u00e1-lo e tamb\u00e9m verificar se j\u00e1 foram comprometidos.<\/p>\n

    Detec\u00e7\u00e3o de eleva\u00e7\u00e3o de privil\u00e9gios no dom\u00ednio<\/b><\/h2>\n

    \nEm DatAlert<\/a><\/noindex> crie uma regra personalizada para monitorar altera\u00e7\u00f5es nas permiss\u00f5es de determinados objetos. Ela ser\u00e1 acionada quando permiss\u00f5es e direitos forem adicionados ao objeto de interesse no dom\u00ednio:<\/p>\n

      \n
    1. Especifique o nome da regra<\/li>\n
    2. Defina a categoria como \"Eleva\u00e7\u00e3o de privil\u00e9gios\" <\/li>\n
    3. Defina o valor para o tipo de recurso como \"Todos os tipos de recursos\" <\/li>\n
    4. Servidor de arquivos = DirectoryServices <\/li>\n
    5. Especifique o dom\u00ednio de seu interesse, como por nome <\/li>\n
    6. Adicione um filtro para a adi\u00e7\u00e3o de permiss\u00f5es no objeto AD <\/li>\n
    7. E n\u00e3o se esque\u00e7a de deixar a op\u00e7\u00e3o \"Pesquisar em objetos filhos\" desmarcada <\/li>\n<\/ol>\n

      \n\"Vulnerabilidade
      \n<\/p>\n

      Agora o relat\u00f3rio: detec\u00e7\u00e3o de altera\u00e7\u00e3o de permiss\u00f5es no objeto de dom\u00ednio <\/b><\/h2>\n

      \nMudan\u00e7as nas permiss\u00f5es do objeto AD s\u00e3o bastante raras, portanto, tudo o que gerou este alerta precisa ser investigado. Tamb\u00e9m seria bom testar a apar\u00eancia e o conte\u00fado do relat\u00f3rio antes de ativar a regra.<\/p>\n

      Este relat\u00f3rio tamb\u00e9m mostrar\u00e1 se voc\u00ea j\u00e1 foi comprometido por esse ataque:<\/p>\n

      \"Vulnerabilidade
      \n
      \nAp\u00f3s a ativa\u00e7\u00e3o da regra, \u00e9 poss\u00edvel investigar todos os outros eventos de eleva\u00e7\u00e3o de privil\u00e9gios usando a interface web do DatAlert:<\/p>\n

      \"Vulnerabilidade
      \n
      \nDepois de configurar esta regra, voc\u00ea poder\u00e1 monitorar e se proteger contra esses e outros tipos semelhantes de vulnerabilidades de seguran\u00e7a, investigar eventos com objetos de servi\u00e7os de diret\u00f3rio AD e verificar se voc\u00ea est\u00e1 vulner\u00e1vel a essa cr\u00edtica falha.
      \n
      Fonte:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidade do Exchange: como detectar eleva\u00e7\u00e3o de privil\u00e9gios para administrador de dom\u00ednio | ProHoster","description":"A vulnerabilidade descoberta este ano no Exchange permite que qualquer usu\u00e1rio do dom\u00ednio obtenha.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}