{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"P\u00ebrgjegjshm\u00ebria Exchange: si t\u00eb zbulohet rritja e privilegjeve deri n\u00eb administrator t\u00eb domainit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

E zbuluar k\u00ebt\u00eb vit ndryshimi n\u00eb Exchange<\/a><\/noindex> lejon \u00e7do p\u00ebrdorues t\u00eb domainit t\u00eb marr\u00eb t\u00eb drejtat e administratorit t\u00eb domainit dhe t\u00eb compromitoj\u00eb Active Directory (AD) dhe hostet e tjera t\u00eb lidhura. Sot do t\u00eb flasim p\u00ebr m\u00ebnyr\u00ebn se si funksionon ky sulm dhe si ta zbulojm\u00eb at\u00eb. <\/p>\n

\"P\u00ebrgjegjshm\u00ebria
\n<\/a><\/noindex>
\n K\u00ebshtu funksionon ky sulm:<\/b><\/p>\n

    \n
  1. Sulmuesi merr kontrollin e llogaris\u00eb s\u00eb \u00e7do p\u00ebrdoruesi t\u00eb domainit me nj\u00eb kuti postare aktive p\u00ebr t\u00eb subscribuar n\u00eb funksionin e njoftimeve push nga Exchange<\/li>\n
  2. Sulmuesi p\u00ebrdor NTLM relay p\u00ebr t\u00eb mashtruar serverin Exchange: si rezultat, serveri Exchange lidhet me kompjuterin e p\u00ebrdoruesit t\u00eb komprometuar duke p\u00ebrdorur metod\u00ebn NTLM mbi HTTP, e cila m\u00eb pas p\u00ebrdoret nga sulmuesi p\u00ebr t\u00eb kaluar procedur\u00ebn e autentifikimit n\u00eb kontrollorin e domainit p\u00ebrmes LDAP me t\u00eb dh\u00ebnat e llogaris\u00eb Exchange<\/li>\n
  3. Si rezultat, sulmuesi p\u00ebrdor k\u00ebto privilegje t\u00eb llogaris\u00eb Exchange p\u00ebr t\u00eb rritur privilegjet e tij. Ky hap i fundit gjithashtu mund t\u00eb realizohet nga nj\u00eb administrator i konfiguruar n\u00eb m\u00ebnyr\u00eb armiq\u00ebsore q\u00eb tashm\u00eb ka qasje legjitime p\u00ebr t\u00eb b\u00ebr\u00eb ndryshimin e nevojsh\u00ebm t\u00eb t\u00eb drejtave. Duke krijuar nj\u00eb rregull p\u00ebr t\u00eb zbuluar k\u00ebt\u00eb aktivitet, ju do t\u00eb jeni t\u00eb mbrojtur nga ky dhe sulme t\u00eb ngjashme.<\/li>\n<\/ol>\n

    \nM\u00eb pas, sulmuesi mund, p\u00ebr shembull, t\u00eb ekzekutoj\u00eb DCSync p\u00ebr t\u00eb marr\u00eb hash-t\u00eb e fjal\u00ebkalimeve t\u00eb t\u00eb gjith\u00eb p\u00ebrdoruesve t\u00eb domainit. Kjo do t'i lejoj\u00eb atij t\u00eb realizoj\u00eb lloje t\u00eb ndryshme sulmesh \u2014 nga sulmet mbi bilet\u00ebn e art\u00eb deri te transferimi i hashes.<\/p>\n

    Ekipi k\u00ebrkues Varonis e ka studiuar n\u00eb detaje k\u00ebt\u00eb vektor sulmi dhe ka p\u00ebrgatitur nj\u00eb udh\u00ebzues p\u00ebr klient\u00ebt tan\u00eb, p\u00ebr ta zbuluar dhe nj\u00ebkoh\u00ebsisht p\u00ebr t\u00eb kontrolluar n\u00ebse ata jan\u00eb komprometuar tashm\u00eb.<\/p>\n

    Zbulimi i rritjes s\u00eb privilegjeve n\u00eb domain<\/b><\/h2>\n

    \nN\u00eb DatAlert<\/a><\/noindex> krijoni nj\u00eb rregull p\u00ebrdoruesi p\u00ebr t\u00eb ndjekur ndryshimet n\u00eb disa leje t\u00eb caktuara mbi objektin. Ajo do t\u00eb aktivizohet kur t\u00eb shtohen t\u00eb drejtat dhe lejet mbi objektin e interesuar n\u00eb domain:<\/p>\n

      \n
    1. Specifikoni emrin e rregullit<\/li>\n
    2. Caktoni kategorin\u00eb si \"Rritje privilegjesh\" <\/li>\n
    3. Caktoni vler\u00ebn p\u00ebr llojin e burimit \"T\u00eb gjitha llojet e burimeve\" <\/li>\n
    4. Serveri i skedar\u00ebve = DirectoryServices <\/li>\n
    5. Specifikoni domainin e interesuar, p\u00ebr shembull, sipas emrit <\/li>\n
    6. Shtoni nj\u00eb filtrin p\u00ebr shtimin e lejeve mbi objektin AD <\/li>\n
    7. Dhe mos harroni t\u00eb lini pa sh\u00ebnuar opsionin \"K\u00ebrko n\u00eb objektet f\u00ebmij\u00eb\" <\/li>\n<\/ol>\n

      \n\"P\u00ebrgjegjshm\u00ebria
      \n<\/p>\n

      Tani \u00ebsht\u00eb raporti: zbulimi i ndryshimeve t\u00eb t\u00eb drejtave mbi objektin e domenit <\/b><\/h2>\n

      \nNdryshimet e lejeve mbi objektin AD jan\u00eb nj\u00eb fenomen mjaft t\u00eb rrall\u00eb, prandaj \u00e7do gj\u00eb q\u00eb shkaktoi k\u00ebt\u00eb paralajm\u00ebrim duhet dhe duhet t\u00eb hetohet. Gjithashtu, \u00ebsht\u00eb mir\u00eb t\u00eb testoni pamjen dhe p\u00ebrmbajtjen e raportit para se ta nxirrni n\u00eb p\u00ebrdorim rregullin e vet.<\/p>\n

      Ky raport gjithashtu do t\u00eb tregoj\u00eb n\u00ebse ju jeni prekur tashm\u00eb nga ky sulm:<\/p>\n

      \"P\u00ebrgjegjshm\u00ebria
      \n
      \nPas aktivizimit t\u00eb rregullit, mund t\u00eb hetoni t\u00eb gjitha ngjarjet e tjera t\u00eb rritjes s\u00eb privilegjeve duke p\u00ebrdorur nd\u00ebrfaqen n\u00eb web t\u00eb DatAlert:<\/p>\n

      \"P\u00ebrgjegjshm\u00ebria
      \n
      \nPas konfigurimit t\u00eb k\u00ebtij rregulli do t\u00eb jeni n\u00eb gjendje t\u00eb monitoroni dhe mbroheni nga k\u00ebto dhe tipa t\u00eb ngjash\u00ebm t\u00eb dob\u00ebsive t\u00eb siguris\u00eb, t\u00eb hetoni ngjarjet me objektet e sh\u00ebrbimeve t\u00eb katalog\u00ebve AD dhe t\u00eb kontrolloni n\u00ebse jeni t\u00eb ekspozuar ndaj k\u00ebsaj dob\u00ebsie kritike.
      \n
      Burimi:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia e Exchange: si t\u00eb zbuloni rritjen e privilegjeve deri te administratori i domenit | ProHoster","description":"Dob\u00ebsia e zbuluar k\u00ebt\u00eb vit n\u00eb Exchange lejon \u00e7do p\u00ebrdorues t\u00eb domenit t\u00eb aksesoj\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}