{"id":53879,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/problema-konfidentsialnosti-dannyh-v-active-directory"},"modified":"2020-02-18T14:01:49","modified_gmt":"2020-02-18T11:01:49","slug":"problema-konfidentsialnosti-dannyh-v-active-directory","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","title":{"rendered":"Problemi i privat\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave n\u00eb Active Directory","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Problemi
\n
\nUn\u00eb kam b\u00ebr\u00eb teste penetrimi duke p\u00ebrdorur PowerView<\/a><\/noindex> dhe e kam p\u00ebrdorur at\u00eb p\u00ebr t\u00eb nxjerr\u00eb informacion mbi p\u00ebrdoruesit nga Active Directory (m\u00eb tej \u2013 AD). N\u00eb at\u00eb koh\u00eb, p\u00ebrqendrohesha n\u00eb mbledhjen e informacionit mbi an\u00ebtar\u00ebsimin n\u00eb grupet e sigurimit dhe m\u00eb pas e p\u00ebrdorja k\u00ebt\u00eb informacion p\u00ebr t\u00eb l\u00ebvizur n\u00eb rrjet. N\u00eb \u00e7do rast, AD p\u00ebrmban t\u00eb dh\u00ebna t\u00eb ndjeshme mbi punonj\u00ebsit, disa prej t\u00eb cil\u00ebve me t\u00eb v\u00ebrtet\u00eb nuk duhet t\u00eb jen\u00eb t\u00eb aksesueshme p\u00ebr t\u00eb gjith\u00eb n\u00eb organizat\u00eb. N\u00eb fakt, n\u00eb sistemet e skedar\u00ebve t\u00eb Windows ekziston nj\u00eb problem ekuivalent \u00abT\u00eb gjith\u00eb\u00bb<\/a><\/noindex>, q\u00eb gjithashtu mund t\u00eb p\u00ebrdoret nga sulmuesit e brendsh\u00ebm dhe t\u00eb jasht\u00ebm.<\/p>\n

Por para se t\u00eb flasim mbi problemet e privat\u00ebsis\u00eb dhe m\u00ebnyrat p\u00ebr t\u2019i zgjidhur ato, le t\u00eb hedhim nj\u00eb v\u00ebshtrim mbi t\u00eb dh\u00ebnat q\u00eb ruhen n\u00eb AD.
\n<\/a><\/noindex><\/p>\n

Active Directory \u00ebsht\u00eb Facebook-u korporativ <\/h2>\n

\nPor n\u00eb k\u00ebt\u00eb rast, ju tashm\u00eb jeni miq me t\u00eb gjith\u00eb! Ndoshta nuk do t\u00eb dini p\u00ebr filmat, librat dhe restorantet e preferuara t\u00eb koleg\u00ebve tuaj, por AD p\u00ebrmban t\u00eb dh\u00ebna kontaktimi t\u00eb ndjeshme
\ndhe fusha t\u00eb tjera q\u00eb mund t\u00eb p\u00ebrdoren nga hakerat dhe madje edhe nga ata brenda organizat\u00ebs pa ndonj\u00eb aft\u00ebsi teknike t\u00eb ve\u00e7ant\u00eb.<\/p>\n

Administrator\u00ebt e sistemeve, sigurisht, jan\u00eb t\u00eb njohur me ekranin m\u00eb posht\u00eb. Ky \u00ebsht\u00eb nd\u00ebrfaqja e Active Directory Users dhe Computers (ADUC), ku ata vendosin dhe redaktojn\u00eb informacionin p\u00ebr p\u00ebrdoruesit dhe i caktojn\u00eb ata n\u00eb grupe t\u00eb p\u00ebrshtatshme.<\/p>\n

\"Problemi
\n
\nAD p\u00ebrmban fusha si emri i punonj\u00ebsit, adresa dhe numri i telefonit, k\u00ebshtu q\u00eb ngjan me nj\u00eb direktori telefonike. Por aty ka shum\u00eb m\u00eb tep\u00ebr! N\u00eb skedat e tjera ka gjithashtu adres\u00eb elektronike dhe t\u00eb uebit, shefi i drejtp\u00ebrdrejt\u00eb dhe sh\u00ebnime.<\/p>\n

A duhet gjith\u00eb organizata t\u00eb shoh\u00eb k\u00ebt\u00eb informacion, ve\u00e7an\u00ebrisht n\u00eb epok\u00ebn e OSINT<\/a><\/noindex>, kur \u00e7do detaj d\u00ebshmues e b\u00ebn k\u00ebrkimin e informacionit t\u00eb m\u00ebtejsh\u00ebm edhe m\u00eb t\u00eb leht\u00eb?<\/p>\n

Sigurisht, jo! Problemi p\u00ebrkeq\u00ebsohet kur t\u00eb dh\u00ebnat e menaxhmentit t\u00eb lart\u00eb jan\u00eb t\u00eb aksesueshme p\u00ebr t\u00eb gjith\u00eb punonj\u00ebsit.<\/p>\n

PowerView p\u00ebr t\u00eb gjith\u00eb<\/h2>\n

\nK\u00ebtu hyn n\u00eb loj\u00eb PowerView. Ai ofron nj\u00eb nd\u00ebrfaqe shum\u00eb t\u00eb p\u00ebrshtatshme PowerShell p\u00ebr funksionet e l\u00ebna pas (dhe t\u00eb komplikuara) Win32, q\u00eb nd\u00ebrveprojn\u00eb me AD. N\u00eb shkurt,
\nkjo e b\u00ebn marrjen e fushave t\u00eb AD kaq t\u00eb leht\u00eb sa shkruajtja e nj\u00eb komandat shum\u00eb t\u00eb shkurt\u00ebr.<\/p>\n

Le ta marrim nj\u00eb shembull t\u00eb mbledhjes s\u00eb informacionit mbi punonj\u00ebsin Cruella Deville, e cila \u00ebsht\u00eb nj\u00eb nga menaxher\u00ebt e kompanis\u00eb. P\u00ebr k\u00ebt\u00eb, do t\u00eb p\u00ebrdorim komand\u00ebn PowerView get-NetUser:<\/p>\n

\"Problemi
\n
\nInstalimi i PowerView nuk \u00ebsht\u00eb nj\u00eb problem serioz \u2013 sigurohuni p\u00ebr k\u00ebt\u00eb vet\u00eb n\u00eb faqen github<\/a><\/noindex>. Dhe m\u00eb e r\u00ebnd\u00ebsishmja, ju nuk keni nevoj\u00eb p\u00ebr privilegje t\u00eb larta p\u00ebr t\u00eb kryer shum\u00eb komanda PowerView, si\u00e7 \u00ebsht\u00eb get-NetUser. K\u00ebshtu, nj\u00eb punonj\u00ebs i motivuar, por jo shum\u00eb teknik mund t\u00eb filloj\u00eb t\u00eb hulumtoj\u00eb n\u00eb AD pa ndonj\u00eb p\u00ebrpjekje t\u00eb madhe.<\/p>\n

Nga shembulli i m\u00ebsip\u00ebrm, duket se nj\u00eb insider mund t\u00eb m\u00ebsoj\u00eb shum\u00eb gj\u00ebra t\u00eb reja rreth Cruella. A e v\u00ebreni gjithashtu se n\u00eb fush\u00ebn \"info\" zbulohen informacione rreth zakon\u00ebve personale dhe fjal\u00ebkalimit t\u00eb p\u00ebrdoruesit?<\/p>\n

Kjo nuk \u00ebsht\u00eb nj\u00eb probabilitet teorik. Nga bisedat me pentester\u00ebt e tjer\u00eb<\/a><\/noindex> m\u00ebsova se ata skanojn\u00eb AD p\u00ebr t\u00eb gjetur fjal\u00ebkalime n\u00eb form\u00eb t\u00eb qart\u00eb, dhe shum\u00eb shpesh k\u00ebto p\u00ebrpjekje, fatkeq\u00ebsisht, jan\u00eb t\u00eb suksesshme. Ata din\u00eb se kompanit\u00eb jan\u00eb t\u00eb pashqet\u00ebsuara ndaj informacionit n\u00eb AD dhe, zakonisht, nuk din\u00eb p\u00ebr tem\u00ebn tjet\u00ebr \u2013 lejet n\u00eb AD.<\/p>\n

N\u00eb Active Directory ka ACL t\u00eb veta<\/h2>\n

\nNd\u00ebrfaqja AD Users and Computers lejon t\u00eb vendosen leje p\u00ebr objektet e AD. N\u00eb AD ekzistojn\u00eb ACL dhe administrator\u00ebt mund t'i caktojn\u00eb ose ndalojn\u00eb aksesin p\u00ebrmes tyre. Duhet t\u00eb klikoni \"Advanced\" n\u00eb menun\u00eb e pamjes ADUC, dhe pastaj, kur t\u00eb hapni p\u00ebrdoruesin, do t\u00eb shihni sked\u00ebn \"Security\", ku vendosni ACL. <\/p>\n

N\u00eb skenarin tim me Cruella, nuk doja q\u00eb t\u00eb gjith\u00eb p\u00ebrdoruesit e verifikuar (Authenticated Users) t\u00eb mund t\u00eb shikonin informacionin e saj personal, prandaj ia ndala atyre aksesin p\u00ebr t\u00eb lexuar:<\/p>\n

\"Problemi
\n
\nDhe tani p\u00ebrdoruesi i zakonsh\u00ebm do ta shoh\u00eb k\u00ebt\u00eb, n\u00ebse p\u00ebrpiqet t\u00eb p\u00ebrdor\u00eb Get-NetUser n\u00eb PowerView:<\/p>\n

\"Problemi
\n
\nMund t\u00eb kisha fshehur informacionin e dobish\u00ebm nga syt\u00eb e huaj. P\u00ebr ta mbajtur aksesin n\u00eb t\u00eb p\u00ebr p\u00ebrdoruesit relevant\u00eb, krijova nj\u00eb ACL tjet\u00ebr p\u00ebr t\u00eb lejuar an\u00ebtar\u00ebt e grupit VIP (Cruella dhe koleg\u00ebt e saj t\u00eb lart\u00eb) t\u00eb ken\u00eb akses n\u00eb k\u00ebto t\u00eb dh\u00ebna konfidenciale. N\u00eb fjal\u00eb t\u00eb tjera, implementova leje AD mbi baz\u00ebn e modelit t\u00eb rolit, duke b\u00ebr\u00eb q\u00eb t\u00eb dh\u00ebnat e ndjeshme t\u00eb ishin t\u00eb paarritshme p\u00ebr shumic\u00ebn e punonj\u00ebsve, p\u00ebrfshir\u00eb insidere.<\/p>\n

Megjithat\u00eb, mund t\u00eb b\u00ebni an\u00ebtar\u00ebsimin n\u00eb grup t\u00eb paduksh\u00ebm p\u00ebr p\u00ebrdoruesit, duke vendosur p\u00ebrkat\u00ebsisht ACL p\u00ebr objektin e grupit n\u00eb AD. Kjo do t\u00eb ndihmoj\u00eb n\u00eb aspektin e privat\u00ebsis\u00eb dhe siguris\u00eb.<\/p>\n

N\u00eb serin\u00eb time t\u00eb epik\u00ebve t\u00eb pentestimeve<\/a><\/noindex> tregoja se si mund t\u00eb l\u00ebvizje n\u00eb sistem, duke studiuar an\u00ebtar\u00ebsimin n\u00eb grupet me an\u00eb t\u00eb PowerView Get-NetGroupMember. N\u00eb skenarin tim kufizova aksesin p\u00ebr t\u00eb lexuar n\u00eb an\u00ebtar\u00ebsimin e nj\u00eb grupi t\u00eb caktuar. Ju shihni rezultatin e ekzekutimit t\u00eb komand\u00ebs para dhe pas ndryshimeve:<\/p>\n

\"Problemi
\n
\nMund t\u00eb kisha fshehur an\u00ebtar\u00ebsimin e Cruella dhe Monty Burns n\u00eb grupin VIP, duke e b\u00ebr\u00eb m\u00eb t\u00eb v\u00ebshtir\u00eb p\u00ebr hakerat dhe insidert\u00eb t\u00eb zbulonin infrastruktur\u00ebn.<\/p>\n

Ky post ishte i destinuar p\u00ebr t'ju motivuar t\u00eb shqyrtoni m\u00eb shum\u00eb fushat
\nAD dhe lejet e lidhura me to. AD \u00ebsht\u00eb nj\u00eb burim i shk\u00eblqyer, por mendoni se si do t\u00eb donit t\u00eb ndaheshit
\ninformacione konfidenciale dhe t\u00eb dh\u00ebna personale, ve\u00e7an\u00ebrisht,
\nkur b\u00ebhet fjal\u00eb p\u00ebr lider\u00ebt e par\u00eb t\u00eb organizat\u00ebs suaj. \u00a0
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PowerView \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0435\u0433\u043e \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u0445 \u0438\u0437 Active Directory (\u0434\u0430\u043b\u0435\u0435 \u2013 AD). \u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u044f \u0434\u0435\u043b\u0430\u043b \u0430\u043a\u0446\u0435\u043d\u0442 \u043d\u0430 \u0441\u0431\u043e\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0447\u043b\u0435\u043d\u0441\u0442\u0432\u0435 \u0432 \u0433\u0440\u0443\u043f\u043f\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u044d\u0442\u0443 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0447\u0442\u043e\u0431\u044b \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438. \u0412 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, AD \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u0445, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53879","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Problemi i privat\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave n\u00eb Active Directory | ProHoster","description":"Un\u00eb kam qen\u00eb duke u marr\u00eb me testime n\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 Active Directory | ProHoster","og:description":"\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53879","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:08:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:08:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53879","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=53879"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53879\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=53879"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=53879"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=53879"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}