{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"Vulnerabiliteti i Exchange: si t\u00eb zbuloni ngritjen e privilegjeve n\u00eb administrator t\u00eb domenit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

E zbuluar k\u00ebt\u00eb vit vulnerabiliteti n\u00eb Exchange<\/a><\/noindex> lejon \u00e7do p\u00ebrdorues t\u00eb domenit t\u00eb fitoj\u00eb t\u00eb drejtat e administratorit t\u00eb domenit dhe t\u00eb komprometoj\u00eb Active Directory (AD) dhe hoste t\u00eb tjera t\u00eb lidhura. Sot do t\u00eb flasim p\u00ebr m\u00ebnyr\u00ebn se si funksionon k\u00ebt\u00eb sulm dhe si ta zbuloni at\u00eb. <\/p>\n

\"Vulnerabiliteti
\n<\/a><\/noindex>
\n Ja si funksionon ky sulm:<\/b><\/p>\n

    \n
  1. Sulmuesi merr kontrollin e llogaris\u00eb s\u00eb \u00e7do p\u00ebrdoruesi t\u00eb domenit me nj\u00eb mailbox aktiv, p\u00ebr t\u00eb u regjistruar n\u00eb funksionin e njoftimeve t\u00eb shtyr\u00eb nga Exchange<\/li>\n
  2. Sulmuesi p\u00ebrdor NTLM relay p\u00ebr t\u00eb mashtruar serverin Exchange: si pasoj\u00eb, serveri Exchange lidhet me kompjuterin e p\u00ebrdoruesit t\u00eb komprometuar p\u00ebrmes metod\u00ebs NTLM mbi HTTP, t\u00eb cil\u00ebn sulmuesi m\u00eb pas e p\u00ebrdor p\u00ebr t\u00eb kaluar procedur\u00ebn e autentifikimit n\u00eb kontrollorin e domenit p\u00ebrmes LDAP me t\u00eb dh\u00ebnat e llogaris\u00eb Exchange<\/li>\n
  3. N\u00eb fund, hakeri p\u00ebrdor k\u00ebto t\u00eb drejta t\u00eb llogaris\u00eb Exchange p\u00ebr t\u00eb rritur privilegjet e tij. Ky hap i fundit mund t\u00eb realizohet gjithashtu nga nj\u00eb administrator i vendosur armiq\u00ebsisht, i cili tashm\u00eb ka nj\u00eb qasje legjitime, p\u00ebr t\u00eb b\u00ebr\u00eb ndryshimin e nevojsh\u00ebm t\u00eb t\u00eb drejtave. Duke krijuar nj\u00eb rregull p\u00ebr t\u00eb zbuluar k\u00ebt\u00eb aktivitet, do t\u00eb jeni t\u00eb mbrojtur nga ky dhe sulme t\u00eb ngjashme.<\/li>\n<\/ol>\n

    \nM\u00eb pas, hakeri mund, p\u00ebr shembull, t\u00eb ekzekutoj\u00eb DCSync p\u00ebr t\u00eb marr\u00eb fjal\u00ebkalimet e hash-uara t\u00eb t\u00eb gjith\u00eb p\u00ebrdoruesve t\u00eb domenit. Kjo do t'i lejoj\u00eb atij t\u00eb realizoj\u00eb lloje t\u00eb ndryshme sulmesh \u2014 nga sulmet e biletes s\u00eb art\u00eb deri te transferimi i hash-it.<\/p>\n

    Ekipi k\u00ebrkues i Varonis ka shqyrtuar n\u00eb detaje k\u00ebt\u00eb vektor sulmi dhe ka p\u00ebrgatitur nj\u00eb udh\u00ebzues p\u00ebr klient\u00ebt tan\u00eb p\u00ebr ta zbuluar dhe gjithashtu p\u00ebr t\u00eb verifikuar n\u00ebse ata jan\u00eb kompromis.<\/p>\n

    Zbulimi i rritjes s\u00eb privilegjeve n\u00eb domen<\/b><\/h2>\n

    \nN\u00eb DatAlert<\/a><\/noindex> krijoni nj\u00eb rregull t\u00eb personalizuar p\u00ebr t\u00eb ndjekur ndryshimet n\u00eb lejet specifike t\u00eb objektit. Ai do t\u00eb aktivizohet kur shtohen t\u00eb drejta dhe leje p\u00ebr objektin e interesit n\u00eb domain:<\/p>\n

      \n
    1. Specifikoni emrin e rregullit<\/li>\n
    2. Caktoni kategorin\u00eb si \"Rritje privilegjesh\" <\/li>\n
    3. Caktoni vler\u00ebn p\u00ebr llojin e burimeve \u201eT\u00eb gjitha llojet e burimeve\u201c <\/li>\n
    4. Serveri i skedar\u00ebve = DirectoryServices <\/li>\n
    5. Caktoni domenin q\u00eb ju intereson, p\u00ebr shembull, sipas emrit <\/li>\n
    6. Shtoni nj\u00eb filt\u00ebr p\u00ebr shtimin e lejeve n\u00eb objektin AD <\/li>\n
    7. Dhe mos harroni t\u00eb lini t\u00eb pap\u00ebrzgjedhur opsionin \u201eK\u00ebrko n\u00eb objektet f\u00ebmij\u00eb\u201c <\/li>\n<\/ol>\n

      \n\"Vulnerabiliteti
      \n<\/p>\n

      Tani raporti: zbulimi i ndryshimit t\u00eb t\u00eb drejtave n\u00eb objektin e domenit <\/b><\/h2>\n

      \nNdryshimet e lejeve n\u00eb objektin AD jan\u00eb nj\u00eb fenomen mjaft i rrall\u00eb, prandaj gjith\u00e7ka q\u00eb ka shkaktuar k\u00ebt\u00eb paralajm\u00ebrim duhet t\u00eb hetohet. Do ishte gjithashtu mir\u00eb t\u00eb testonit pamjen dhe p\u00ebrmbajtjen e raportit p\u00ebrpara se ta vendosnin n\u00eb p\u00ebrdorim rregullin e vet\u00eb.<\/p>\n

      Ky raport gjithashtu do t\u00eb tregoj\u00eb n\u00ebse ju jeni komprometuar tashm\u00eb nga ky sulm:<\/p>\n

      \"Vulnerabiliteti
      \n
      \nPas aktivizimit t\u00eb rregullit, mund t\u00eb hetoni t\u00eb gjitha ngjarjet e tjera t\u00eb rritjes s\u00eb privilegjeve duke p\u00ebrdorur nd\u00ebrfaqen web t\u00eb DatAlert:<\/p>\n

      \"Vulnerabiliteti
      \n
      \nPas konfigurimit t\u00eb k\u00ebtij rregulli, do t\u00eb jeni n\u00eb gjendje t\u00eb monitoroni dhe mbroni nga k\u00ebto dhe lloje t\u00eb ngjashme t\u00eb dob\u00ebsive t\u00eb sistemit t\u00eb siguris\u00eb, t\u00eb hetoni ngjarje me objektet e sh\u00ebrbimeve t\u00eb katalog\u00ebve AD dhe t\u00eb kontrolloni n\u00ebse jeni t\u00eb ekspozuar ndaj k\u00ebsaj dob\u00ebsie kritike.
      \n
      Burimi:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia Exchange: si t\u00eb zbuloni ngritjen e privilegjeve n\u00eb administrator t\u00eb domain-it | ProHoster","description":"Nj\u00eb dob\u00ebsi e zbuluar k\u00ebt\u00eb vit n\u00eb Exchange lejon \u00e7do p\u00ebrdorues t\u00eb domain-it t\u00eb fitoj\u00eb t\u00eb drejta administratori dhe t\u00eb komprometoj\u00eb Active Directory (AD) dhe hostet e tjer\u00eb t\u00eb lidhur. Sot do t\u00eb flasim p\u00ebr m\u00ebnyr\u00ebn se si funksionon kjo sulm dhe si ta zbulojm\u00eb at\u00eb. K\u00ebshtu e realizon sulmin: Sulmuesi merr kontrollin e nj\u00eb llogarie t\u00eb p\u00ebrdoruesit t\u00eb domain-it q\u00eb ka nj\u00eb kutin\u00eb postare aktive, p\u00ebr t'u regjistruar p\u00ebr funksionalitetin","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}