{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"Zranite\u013enos\u0165 Exchange: ako odhali\u0165 zv\u00fd\u0161en\u00e9 opr\u00e1vnenia do administr\u00e1tora dom\u00e9ny","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zisten\u00e1 v tomto roku zranite\u013enos\u0165 v Exchange<\/a><\/noindex> umo\u017e\u0148uje ak\u00e9muko\u013evek u\u017e\u00edvate\u013eovi dom\u00e9ny z\u00edska\u0165 administr\u00e1torsk\u00e9 pr\u00e1va dom\u00e9ny a skompromitova\u0165 Active Directory (AD) a \u010fal\u0161ie pripojen\u00e9 hosty. Dnes v\u00e1m uk\u00e1\u017eeme, ako funguje tento \u00fatok a ako ho odhali\u0165. <\/p>\n

\"Zranite\u013enos\u0165
\n<\/a><\/noindex>
\n Takto funguje tento \u00fatok:<\/b><\/p>\n

    \n
  1. \u00dato\u010dn\u00edk z\u00edskava \u00fa\u010det ak\u00e9hoko\u013evek dom\u00e9nov\u00e9ho u\u017e\u00edvate\u013ea s akt\u00edvnou e-mailovou schr\u00e1nkou, aby sa prihl\u00e1sil na funkciu push-ozn\u00e1men\u00ed od Exchange.<\/li>\n
  2. \u00dato\u010dn\u00edk pou\u017e\u00edva NTLM relay na oklamanie servera Exchange: v d\u00f4sledku toho sa server Exchange pripoj\u00ed na po\u010d\u00edta\u010d skompromitovan\u00e9ho u\u017e\u00edvate\u013ea pomocou met\u00f3dy NTLM over HTTP, ktor\u00fa \u00fato\u010dn\u00edk potom pou\u017eije na prechod overovac\u00edm procesom na dom\u00e9novom ovl\u00e1da\u010di prostredn\u00edctvom LDAP s \u00fadajmi \u00fa\u010dtu Exchange.<\/li>\n
  3. Nakoniec \u00fato\u010dn\u00edk vyu\u017e\u00edva tieto opr\u00e1vnenia \u00fa\u010dtu Exchange na zv\u00fd\u0161enie svojich opr\u00e1vnen\u00ed. Tento posledn\u00fd krok m\u00f4\u017ee by\u0165 tie\u017e vykonan\u00fd nepriate\u013esky zameran\u00fdm administr\u00e1torom, ktor\u00fd u\u017e m\u00e1 legit\u00edmny pr\u00edstup, aby vykonal potrebn\u00fa zmenu pr\u00e1v. Vytvoren\u00edm pravidla na odha\u013eovanie tejto aktivity sa ochr\u00e1nite pred t\u00fdmto a podobn\u00fdmi \u00fatokmi.<\/li>\n<\/ol>\n

    \nN\u00e1sledne m\u00f4\u017ee \u00fato\u010dn\u00edk napr\u00edklad spusti\u0165 DCSync, aby z\u00edskal hashovan\u00e9 hesl\u00e1 v\u0161etk\u00fdch u\u017e\u00edvate\u013eov dom\u00e9ny. To mu umo\u017en\u00ed realizova\u0165 r\u00f4zne typy \u00fatokov \u2014 od \u00fatokov na golden ticket po prenos hash.<\/p>\n

    V\u00fdskumn\u00fd t\u00edm Varonis podrobne presk\u00famal tento vektor \u00fatoku a pripravil n\u00e1vod pre na\u0161ich klientov, aby ho mohli odhali\u0165 a z\u00e1rove\u0148 skontrolova\u0165, \u010di u\u017e boli skompromitovan\u00ed.<\/p>\n

    Odha\u013eovanie zv\u00fd\u0161enia opr\u00e1vnen\u00ed v dom\u00e9ne<\/b><\/h2>\n

    \nV DatAlert<\/a><\/noindex> vytvorte vlastn\u00e9 pravidlo na sledovanie zmien ur\u010dit\u00fdch opr\u00e1vnen\u00ed na objekte. Bude sa sp\u00fa\u0161\u0165a\u0165 pri prid\u00e1van\u00ed pr\u00e1v a opr\u00e1vnen\u00ed na zauj\u00edmav\u00fd objekt v dom\u00e9ne:<\/p>\n

      \n
    1. Uve\u010fte n\u00e1zov pravidla<\/li>\n
    2. Nastavte kateg\u00f3riu ako \u201eZv\u00fd\u0161enie opr\u00e1vnen\u00ed\u201c <\/li>\n
    3. Nastavte hodnotu pre typ zdroja \u201eV\u0161etky typy zdrojov\u201c <\/li>\n
    4. S\u00faborov\u00fd server = DirectoryServices <\/li>\n
    5. Uve\u010fte dom\u00e9nu, ktor\u00e1 v\u00e1s zauj\u00edma, napr\u00edklad pod\u013ea n\u00e1zvu <\/li>\n
    6. Pridajte filter na pridanie opr\u00e1vnen\u00ed na objekte AD <\/li>\n
    7. A nezabudnite necha\u0165 neza\u0161krtnut\u00fa mo\u017enos\u0165 \u201eH\u013eada\u0165 v podriaden\u00fdch objektoch\u201c <\/li>\n<\/ol>\n

      \n\"Zranite\u013enos\u0165
      \n<\/p>\n

      A teraz spr\u00e1va: odha\u013eovanie zmeny pr\u00e1v na objekte dom\u00e9ny <\/b><\/h2>\n

      \nZmeny opr\u00e1vnen\u00ed na objekte AD s\u00fa dos\u0165 zriedkav\u00e9, preto v\u0161etko, \u010do vyvolalo toto upozornenie, je potrebn\u00e9 a treba presk\u00fama\u0165. Tie\u017e by bolo dobr\u00e9 otestova\u0165 vzh\u013ead a obsah spr\u00e1vy pred spusten\u00edm samotn\u00e9ho pravidla.<\/p>\n

      T\u00e1to spr\u00e1va tie\u017e uk\u00e1\u017ee, \u010di ste u\u017e touto \u00fatokom boli ohrozen\u00ed:<\/p>\n

      \"Zranite\u013enos\u0165
      \n
      \nPo aktiv\u00e1cii pravidla je mo\u017en\u00e9 vy\u0161etrova\u0165 v\u0161etky ostatn\u00e9 udalosti zv\u00fd\u0161enia privilegovan\u00fdch pr\u00e1v pomocou webov\u00e9ho rozhrania DatAlert:<\/p>\n

      \"Zranite\u013enos\u0165
      \n
      \nPo nastaven\u00ed tohto pravidla budete m\u00f4c\u0165 sledova\u0165 a chr\u00e1ni\u0165 sa pred t\u00fdmito a podobn\u00fdmi typmi zranite\u013enost\u00ed bezpe\u010dnostn\u00e9ho syst\u00e9mu, vy\u0161etri\u0165 udalosti s objektmi slu\u017eieb adres\u00e1rov AD a zisti\u0165, \u010di ste vystaven\u00ed tejto kritickej zranite\u013enosti.
      \n
      Zdroj:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 Exchange: ako odhali\u0165 zv\u00fd\u0161enie privilegovan\u00fdch pr\u00e1v na administr\u00e1tora dom\u00e9ny | ProHoster","description":"Zisten\u00e1 v tomto roku zranite\u013enos\u0165 v Exchange umo\u017e\u0148uje ak\u00e9muko\u013evek pou\u017e\u00edvate\u013eovi dom\u00e9ny z\u00edska\u0165.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}