{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"Vulnerabilitatea Exchange: cum s\u0103 detectezi cre\u0219terea privilegiilor la administratorul de domeniu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vulnerabilitatea descoperit\u0103 \u00een acest an \u00een Exchange<\/a><\/noindex> permite oric\u0103rui utilizator de domeniu s\u0103 ob\u021bin\u0103 drepturi de administrator al domeniului \u0219i s\u0103 compromit\u0103 Active Directory (AD) \u0219i alte gazde conectate. Ast\u0103zi v\u0103 vom explica cum func\u021bioneaz\u0103 aceast\u0103 atac \u0219i cum poate fi detectat. <\/p>\n

\"Vulnerabilitatea
\n<\/a><\/noindex>
\n Iat\u0103 cum func\u021bioneaz\u0103 aceast\u0103 atac:<\/b><\/p>\n

    \n
  1. Atacatorul preia contul oric\u0103rui utilizator de domeniu cu o cutie po\u0219tal\u0103 activ\u0103 pentru a se abona la func\u021bia de notific\u0103ri push de la Exchange.<\/li>\n
  2. Atacatorul utilizeaz\u0103 NTLM relay pentru a \u00een\u0219ela serverul Exchange: \u00een cele din urm\u0103, serverul Exchange se conecteaz\u0103 la computerul utilizatorului compromis prin metoda NTLM over HTTP, pe care atacatorul o folose\u0219te ulterior pentru a trece de procedura de autentificare pe controlerul de domeniu prin LDAP cu datele contului Exchange.<\/li>\n
  3. \u00cen cele din urm\u0103, atacatorul utilizeaz\u0103 aceste privilegii ale contului Exchange pentru a-\u0219i cre\u0219te privilegiile. Aceast\u0103 ultim\u0103 etap\u0103 poate fi, de asemenea, efectuat\u0103 de un administrator r\u0103u inten\u021bionat care are deja acces legitim pentru a face modificarea de drepturi necesar\u0103. Cre\u00e2nd o regul\u0103 pentru a detecta aceast\u0103 activitate, ve\u021bi fi protejat \u00eempotriva acestei \u0219i altor atacuri similare.<\/li>\n<\/ol>\n

    \nUlterior, atacatorul poate, de exemplu, s\u0103 execute DCSync pentru a ob\u021bine parolele hash-uite ale tuturor utilizatorilor domeniului. Acest lucru \u00eei va permite s\u0103 execute diverse tipuri de atacuri - de la atacuri pe golden ticket p\u00e2n\u0103 la transferul de hash.<\/p>\n

    Echipa de cercetare Varonis a analizat \u00een detaliu acest vector de atac \u0219i a preg\u0103tit un ghid pentru clien\u021bii no\u0219tri pentru a-l detecta \u0219i pentru a verifica dac\u0103 au fost deja compromise.<\/p>\n

    Detectarea cre\u0219terii privilegiilor \u00een domeniu<\/b><\/h2>\n

    \n\u00cen DatAlert<\/a><\/noindex> crea\u021bi o regul\u0103 personalizat\u0103 pentru a urm\u0103ri modific\u0103rile anumitor permisiuni pe obiect. Aceasta va fi activat\u0103 la ad\u0103ugarea de drepturi \u0219i permisiuni pe obiectul de interes din domeniu:<\/p>\n

      \n
    1. Specifica\u021bi numele regulii<\/li>\n
    2. Stabili\u021bi categoria ca \u201eCre\u0219tere a privilegiilor\u201d <\/li>\n
    3. Stabili\u021bi valoarea pentru tipul resursei \u201eToate tipurile de resurse\u201d <\/li>\n
    4. Server de fi\u0219iere = DirectoryServices <\/li>\n
    5. Specifica\u021bi domeniul care v\u0103 intereseaz\u0103, de exemplu, dup\u0103 nume <\/li>\n
    6. Ad\u0103uga\u021bi un filtru pentru ad\u0103ugarea de permisiuni pe obiectul AD <\/li>\n
    7. \u0218i nu uita\u021bi s\u0103 l\u0103sa\u021bi op\u021biunea \u201eC\u0103utare \u00een obiectele fiice\u201d neactivat\u0103 <\/li>\n<\/ol>\n

      \n\"Vulnerabilitatea
      \n<\/p>\n

      Iar acum raportul: detectarea modific\u0103rii drepturilor pe obiectul domeniului <\/b><\/h2>\n

      \nModific\u0103rile permisiunilor asupra obiectului AD sunt o raritate, a\u0219a c\u0103 orice lucru care a generat aceast\u0103 alert\u0103 trebuie \u0219i trebuie investigat. De asemenea, ar fi bine s\u0103 testa\u021bi aspectul \u0219i con\u021binutul raportului \u00eenainte de a-l lansa \u00een practic\u0103.<\/p>\n

      Acest raport va ar\u0103ta, de asemenea, dac\u0103 a\u021bi fost deja compromis de acest atac:<\/p>\n

      \"Vulnerabilitatea
      \n
      \nDup\u0103 activarea regulii, pute\u021bi investiga toate celelalte evenimente de cre\u0219tere a privilegiilor folosind interfa\u021ba web DatAlert:<\/p>\n

      \"Vulnerabilitatea
      \n
      \nDup\u0103 configurarea acestei reguli, ve\u021bi putea urm\u0103ri \u0219i proteja\u021bi-v\u0103 \u00eempotriva acestor \u0219i a unor tipuri similare de vulnerabilit\u0103\u021bi de securitate, investiga\u021bi evenimentele cu obiectele serviciilor de catalog AD \u0219i verifica\u021bi dac\u0103 sunte\u021bi expus acestei vulnerabilit\u0103\u021bi critice.
      \n
      Sursa:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate Exchange: cum s\u0103 detecta\u021bi cre\u0219terea privilegiilor la administrator de domeniu | ProHoster","description":"Vulnerabilitatea descoperit\u0103 \u00een acest an \u00een Exchange permite oric\u0103rui utilizator din domeniu s\u0103 ob\u021bin\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}