{"id":53879,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/problema-konfidentsialnosti-dannyh-v-active-directory"},"modified":"2020-02-18T14:01:49","modified_gmt":"2020-02-18T11:01:49","slug":"problema-konfidentsialnosti-dannyh-v-active-directory","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","title":{"rendered":"Problema confiden\u021bialit\u0103\u021bii datelor \u00een Active Directory","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Problema
\n
\nAm efectuat teste de penetrare folosind PowerView<\/a><\/noindex> \u0219i l-am folosit pentru a extrage informa\u021bii despre utilizatori din Active Directory (AD). La vremea respectiv\u0103, am pus accent pe colectarea de informa\u021bii despre apartenen\u021ba la grupuri de securitate \u0219i apoi am folosit aceste informa\u021bii pentru a naviga prin re\u021bea. Oricum, AD con\u021bine date confiden\u021biale despre angaja\u021bi, iar unele dintre acestea nu ar trebui s\u0103 fie accesibile tuturor \u00een organiza\u021bie. De fapt, \u00een sistemele de fi\u0219iere Windows exist\u0103 o problem\u0103 echivalent\u0103 \u00abEveryone\u00bb<\/a><\/noindex>, care poate fi folosit\u0103 at\u00e2t de atacatori interni, c\u00e2t \u0219i externi.<\/p>\n

Dar \u00eenainte de a discuta despre problemele de confiden\u021bialitate \u0219i modul \u00een care acestea pot fi rezolvate, s\u0103 ne uit\u0103m la datele stocate \u00een AD.
\n<\/a><\/noindex><\/p>\n

Active Directory este Facebook-ul corporativ <\/h2>\n

\nDar \u00een acest caz, ai f\u0103cut deja prietenie cu toat\u0103 lumea! S-ar putea s\u0103 nu afli despre filmele, c\u0103r\u021bile \u0219i restaurantele preferate ale colegilor t\u0103i, dar AD con\u021bine informa\u021bii de contact sensibile
\n\u0219i alte c\u00e2mpuri care pot fi utilizate de hackeri \u0219i chiar de insideri f\u0103r\u0103 abilit\u0103\u021bi tehnice deosebite.<\/p>\n

Adminii de sistem sunt cu siguran\u021b\u0103 familiariza\u021bi cu captura de ecran de mai jos. Aceasta este interfa\u021ba Active Directory Users and Computers (ADUC), unde ace\u0219tia seteaz\u0103 \u0219i editeaz\u0103 informa\u021biile despre utilizatori \u0219i \u00eei aloc\u0103 \u00een grupurile corespunz\u0103toare.<\/p>\n

\"Problema
\n
\nAD con\u021bine c\u00e2mpuri cu numele angajatului, adresa \u0219i num\u0103rul de telefon, astfel \u00eenc\u00e2t seam\u0103n\u0103 cu un director telefonic. Dar exist\u0103 mult mai mult! Pe alte tab-uri exist\u0103, de asemenea, adresa de email \u0219i adresa web, managerul direct \u0219i note.<\/p>\n

Trebuie ca toat\u0103 lumea din organiza\u021bie s\u0103 vad\u0103 aceste informa\u021bii, mai ales \u00een epoca OSINT<\/a><\/noindex>, c\u00e2nd fiecare detaliu nou face c\u0103utarea de informa\u021bii suplimentare \u0219i mai u\u0219oar\u0103?<\/p>\n

Desigur c\u0103 nu! Problema se \u00eenr\u0103ut\u0103\u021be\u0219te atunci c\u00e2nd datele conducerii superioare a companiei sunt accesibile tuturor angaja\u021bilor.<\/p>\n

PowerView pentru to\u021bi<\/h2>\n

\nAici intervine PowerView. Ofer\u0103 o interfa\u021b\u0103 PowerShell foarte prietenoas\u0103 pentru func\u021biile Win32 de baz\u0103 (\u0219i complicate) care acceseaz\u0103 AD. Pe scurt:
\nacesta face ob\u021binerea c\u00e2mpurilor din AD la fel de simpl\u0103 ca introducerea unui comenzi foarte scurte.<\/p>\n

S\u0103 lu\u0103m un exemplu de colectare a informa\u021biilor despre angajata Cruella Deville, care este unul dintre liderii companiei. Pentru aceasta, vom folosi cmdlet-ul PowerView get-NetUser:<\/p>\n

\"Problema
\n
\nInstalarea PowerView nu este o problem\u0103 serioas\u0103 \u2013 asigura\u021bi-v\u0103 singuri pe pagina github<\/a><\/noindex>. \u0218i, mai important, nu ave\u021bi nevoie de privilegii ridicate pentru a executa multe comenzi PowerView, cum ar fi get-NetUser. Astfel, un angajat motivat, dar nu foarte tehnic, poate \u00eencepe s\u0103 exploreze AD f\u0103r\u0103 prea multe eforturi.<\/p>\n

Din captura de ecran de mai sus, se poate observa c\u0103 un insider poate afla rapid o mul\u021bime de lucruri noi despre Cruella. A\u021bi observat \u0219i c\u0103 \u00een c\u00e2mpul \u201einfo\u201d sunt dezv\u0103luite informa\u021bii despre obiceiurile personale \u0219i parola utilizatorului?<\/p>\n

Aceasta nu este o probabilitate teoretic\u0103. Din dialogurile cu al\u021bi speciali\u0219ti \u00een penetrare<\/a><\/noindex> am aflat c\u0103 ei scaneaz\u0103 AD pentru a c\u0103uta parole \u00een format necriptat, iar adesea aceste \u00eencerc\u0103ri, din p\u0103cate, au succes. Ei \u0219tiu c\u0103 companiile trateaz\u0103 cu neglijen\u021b\u0103 informa\u021biile din AD \u0219i, \u00een general, nu sunt con\u0219tien\u021bi de urm\u0103toarea tem\u0103 \u2013 permisiunile \u00een AD.<\/p>\n

\u00cen Active Directory exist\u0103 propriile ACL<\/h2>\n

\nInterfa\u021ba AD Users and Computers permite stabilirea permisiunilor pentru obiectele AD. \u00cen AD exist\u0103 ACL, iar administratorii pot acorda sau refuza accesul prin intermediul acestora. Trebuie s\u0103 face\u021bi clic pe \u201eAdvanced\u201d \u00een meniul ADUC View, apoi, atunci c\u00e2nd deschide\u021bi utilizatorul, ve\u021bi vedea tab-ul \u201eSecurity\u201d, unde stabili\u021bi ACL. <\/p>\n

\u00cen scenariul meu cu Cruella, nu am vrut ca to\u021bi utilizatorii autentifica\u021bi (Authenticated Users) s\u0103 poat\u0103 vedea informa\u021biile ei personale, a\u0219a c\u0103 le-am interzis accesul la citire:<\/p>\n

\"Problema
\n
\n\u0218i acum un utilizator obi\u0219nuit va vedea acest lucru dac\u0103 va \u00eencerca Get-NetUser \u00een PowerView:<\/p>\n

\"Problema
\n
\nAm reu\u0219it s\u0103 ascund informa\u021biile utile de privirile curioase. Pentru a men\u021bine accesul la acestea pentru utilizatorii relevan\u021bi, am creat un alt ACL, pentru a permite membrilor grupului VIP (Cruella \u0219i ceilal\u021bi colegi de rang \u00eenalt) s\u0103 acceseze aceste date confiden\u021biale. Cu alte cuvinte, am implementat permisiuni AD bazate pe un model de rol, f\u0103c\u00e2nd datele sensibile inaccesibile pentru majoritatea angaja\u021bilor, inclusiv insideri.<\/p>\n

Cu toate acestea, pute\u021bi face ca apartenen\u021ba la grup s\u0103 fie invizibil\u0103 pentru utilizatori, stabilind corespunz\u0103tor ACL pentru obiectul grupului \u00een AD. Acest lucru va ajuta din punct de vedere al confiden\u021bialit\u0103\u021bii \u0219i securit\u0103\u021bii.<\/p>\n

\u00cen propria mea serii epice de pentesting<\/a><\/noindex> Am ar\u0103tat cum se poate naviga \u00een sistem, examin\u00e2nd apartenen\u021ba la grupuri folosind PowerViews Get-NetGroupMember. \u00cen scenariul meu, am restric\u021bionat accesul la citire la apartenen\u021ba la un anumit grup. Observa\u021bi rezultatul execu\u021biei comenzii \u00eenainte \u0219i dup\u0103 modific\u0103ri:<\/p>\n

\"Problema
\n
\nAm reu\u0219it s\u0103 ascund apartenen\u021ba lui Cruella \u0219i Monty Burns \u00een grupul VIP, ceea ce a complicat misiunea hackerilor \u0219i insiderilor de a investiga infrastructura.<\/p>\n

Aceast\u0103 postare a fost destinat\u0103 s\u0103 v\u0103 motiveze s\u0103 examina\u021bi mai atent c\u00e2mpurile
\nAD \u0219i permisiunile asociate. AD este o resurs\u0103 excelent\u0103, dar g\u00e2ndi\u021bi-v\u0103 cum a\u021bi
\ndori s\u0103 \u00eemp\u0103rt\u0103\u0219i\u021bi informa\u021bii confiden\u021biale \u0219i date personale, mai ales,
\nc\u00e2nd vine vorba de persoanele de top din organiza\u021bia dumneavoastr\u0103. \u00a0
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PowerView \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0435\u0433\u043e \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u0445 \u0438\u0437 Active Directory (\u0434\u0430\u043b\u0435\u0435 \u2013 AD). \u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u044f \u0434\u0435\u043b\u0430\u043b \u0430\u043a\u0446\u0435\u043d\u0442 \u043d\u0430 \u0441\u0431\u043e\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0447\u043b\u0435\u043d\u0441\u0442\u0432\u0435 \u0432 \u0433\u0440\u0443\u043f\u043f\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u044d\u0442\u0443 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0447\u0442\u043e\u0431\u044b \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438. \u0412 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, AD \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u0445, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53879","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Problema confiden\u021bialit\u0103\u021bii datelor \u00een Active Directory | ProHoster","description":"Am efectuat teste pe.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 Active Directory | ProHoster","og:description":"\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53879","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:08:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:08:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53879","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=53879"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53879\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=53879"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=53879"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=53879"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}