{"id":53879,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/problema-konfidentsialnosti-dannyh-v-active-directory"},"modified":"2020-02-18T14:01:49","modified_gmt":"2020-02-18T11:01:49","slug":"problema-konfidentsialnosti-dannyh-v-active-directory","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","title":{"rendered":"Problemi i privat\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave n\u00eb Active Directory","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Problemi
\n
\nKam kam testime penetrimin duke p\u00ebrdorur PowerView<\/a><\/noindex> dhe e p\u00ebrdora at\u00eb p\u00ebr t\u00eb nxjerr\u00eb informacion rreth p\u00ebrdoruesve nga Active Directory (n\u00eb vijim \u2013 AD). N\u00eb at\u00eb koh\u00eb, kam v\u00ebn\u00eb theksin n\u00eb mbledhjen e informacionit rreth an\u00ebtar\u00ebsis\u00eb n\u00eb grupet e siguris\u00eb dhe pastaj kam p\u00ebrdorur k\u00ebt\u00eb informacion p\u00ebr t\u00eb l\u00ebvizur n\u00eb rrjet. N\u00eb \u00e7do rast, AD p\u00ebrmban t\u00eb dh\u00ebna t\u00eb ndjeshme rreth punonj\u00ebsve, disa prej t\u00eb cilave me t\u00eb v\u00ebrtet\u00eb nuk duhet t\u00eb jen\u00eb t\u00eb aksesueshme p\u00ebr t\u00eb gjith\u00eb n\u00eb organizat\u00eb. N\u00eb fakt, n\u00eb sistemet e skedar\u00ebve Windows ekziston nj\u00eb problem i barabart\u00eb me \"T\u00eb Gjith\u00ebve\"<\/a><\/noindex>, i cili gjithashtu mund t\u00eb p\u00ebrdoret nga sulmuesit e brendsh\u00ebm dhe t\u00eb jasht\u00ebm.<\/p>\n

Por para se t\u00eb flasim p\u00ebr problemet e privat\u00ebsis\u00eb dhe m\u00ebnyrat p\u00ebr t'i zgjidhur ato, le t\u00eb shohim t\u00eb dh\u00ebnat q\u00eb ruhen n\u00eb AD.
\n<\/a><\/noindex><\/p>\n

Active Directory \u00ebsht\u00eb Facebook-u i korporat\u00ebs <\/h2>\n

\nPor n\u00eb k\u00ebt\u00eb rast, ju tashm\u00eb keni b\u00ebr\u00eb miq me t\u00eb gjith\u00eb! Ndoshta nuk do t\u00eb dini p\u00ebr filmat, librat dhe restorantet e preferuara t\u00eb koleg\u00ebve tuaj, por AD p\u00ebrmban t\u00eb dh\u00ebna kontaktuese t\u00eb ndjeshme
\ndhe fusha t\u00eb tjera q\u00eb mund t\u00eb p\u00ebrdoren nga hakerat dhe madje edhe nga t\u00eb brendshmit pa aft\u00ebsi teknike t\u00eb ve\u00e7anta.<\/p>\n

Administratoret e sistemeve, sigurisht, jan\u00eb t\u00eb njohur me screenshot-in e m\u00ebposht\u00ebm. Ky \u00ebsht\u00eb interfaci i Active Directory Users and Computers (ADUC), ku ata vendosin dhe redaktojn\u00eb informacionin rreth p\u00ebrdoruesve dhe i em\u00ebrojn\u00eb ata n\u00eb grupet p\u00ebrkat\u00ebse.<\/p>\n

\"Problemi
\n
\nAD p\u00ebrmban fusha me emrin e punonj\u00ebsit, adres\u00ebn dhe numrin e telefonit, k\u00ebshtu q\u00eb \u00ebsht\u00eb si nj\u00eb regjist\u00ebr telefonik. Por ka shum\u00eb m\u00eb tep\u00ebr! N\u00eb skeda t\u00eb tjera gjithashtu ka adres\u00eb elektronike dhe faqe interneti, shefi direkt dhe sh\u00ebnime.<\/p>\n

A duhet t\u00eb gjith\u00eb n\u00eb organizat\u00eb t\u00eb shohin k\u00ebt\u00eb informacion, ve\u00e7an\u00ebrisht n\u00eb epok\u00ebn OSINT<\/a><\/noindex>, kur \u00e7do detaj i ri e b\u00ebn k\u00ebrkimin e informacionit t\u00eb shtuar edhe m\u00eb t\u00eb leht\u00eb?<\/p>\n

Sigurisht q\u00eb jo! Problemi p\u00ebrkeq\u00ebsohet kur t\u00eb dh\u00ebnat e udh\u00ebheq\u00ebsve t\u00eb lart\u00eb t\u00eb kompanis\u00eb jan\u00eb n\u00eb dispozicion p\u00ebr t\u00eb gjith\u00eb punonj\u00ebsit.<\/p>\n

PowerView p\u00ebr t\u00eb gjith\u00eb<\/h2>\n

\nK\u00ebtu hyn n\u00eb loj\u00eb PowerView. Ai ofron nj\u00eb nd\u00ebrfaqe shum\u00eb t\u00eb p\u00ebrshtatshme PowerShell p\u00ebr funksionet e Win32 t\u00eb bazuara (dhe t\u00eb nd\u00ebrlikuara) q\u00eb iu qasen AD. N\u00eb pak fjal\u00eb:
\nai e b\u00ebn marrjen e fushave t\u00eb AD po aq t\u00eb leht\u00eb sa t\u00eb shkruash nj\u00eb komand\u00eb shum\u00eb t\u00eb shkurt\u00ebr.<\/p>\n

Le t\u00eb marrim si shembull mbledhjen e informacionit p\u00ebr punonj\u00ebsin Cruella Deville, i cili \u00ebsht\u00eb nj\u00eb nga drejtuesit e kompanis\u00eb. P\u00ebr k\u00ebt\u00eb do t\u00eb p\u00ebrdorim komand\u00ebn PowerView get-NetUser:<\/p>\n

\"Problemi
\n
\nInstalimi i PowerView nuk \u00ebsht\u00eb nj\u00eb problem serioz \u2013 sigurohuni vet\u00eb n\u00eb faqen github<\/a><\/noindex>. Dhe m\u00eb e r\u00ebnd\u00ebsishmja, nuk keni nevoj\u00eb p\u00ebr privilegje t\u00eb larta p\u00ebr t\u00eb ekzekutuar shum\u00eb nga komandat e PowerView, si get-NetUser. K\u00ebshtu, nj\u00eb punonj\u00ebs i motivuar, por jo shum\u00eb teknik, mund t\u00eb filloj\u00eb t\u00eb b\u00ebj\u00eb hulumtime n\u00eb AD pa shum\u00eb v\u00ebshtir\u00ebsi.<\/p>\n

Nga screenshots e m\u00ebsip\u00ebrme, \u00ebsht\u00eb e qart\u00eb se nj\u00eb insajder mund t\u00eb zbuloj\u00eb shpejt shum\u00eb informacione t\u00eb reja rreth Cruella. A keni v\u00ebn\u00eb re gjithashtu se n\u00eb fush\u00ebn 'info' shpaloset informacion mbi zakonet personale dhe fjal\u00ebkalimin e p\u00ebrdoruesit?<\/p>\n

Kjo nuk \u00ebsht\u00eb nj\u00eb probabilitet teorik. Nga bisedat me p\u00ebntestues t\u00eb tjer\u00eb<\/a><\/noindex> m\u00ebsova se ata skanojn\u00eb AD p\u00ebr t\u00eb gjetur fjal\u00ebkalime n\u00eb format t\u00eb pacenuar, dhe shpesh k\u00ebto p\u00ebrpjekje, fatkeq\u00ebsisht, p\u00ebrfundojn\u00eb me sukses. At\u00ebher\u00eb kuptojn\u00eb se kompanit\u00eb e trajtojn\u00eb me neglizhenc\u00eb informacionin n\u00eb AD dhe, p\u00ebr zakonisht, nuk din\u00eb p\u00ebr tem\u00ebn tjet\u00ebr \u2013 nd\u00ebshkimet n\u00eb AD.<\/p>\n

N\u00eb Active Directory ka ACL t\u00eb veta<\/h2>\n

\nNd\u00ebrfaqja AD Users and Computers lejon vendosjen e nd\u00ebshkimeve p\u00ebr objektet AD. N\u00eb AD ekzistojn\u00eb ACL dhe administrator\u00ebt mund t\u00eb caktojn\u00eb ose ndalojn\u00eb aksesin p\u00ebrmes tyre. Duhet t\u00eb klikoni 'Advanced' n\u00eb menun\u00eb ADUC View, dhe pastaj, kur t\u00eb hapni p\u00ebrdoruesin, do t\u00eb shihni seksionin 'Security', ku vendosni ACL. <\/p>\n

N\u00eb skenarin tim me Cruella, nuk doja q\u00eb t\u00eb gjith\u00eb p\u00ebrdoruesit e verifikuar (Authenticated Users) t\u00eb mund t\u00eb shihnin informacionin e saj personal, k\u00ebshtu q\u00eb e ndalova aksesin p\u00ebr t\u00eb lexuar:<\/p>\n

\"Problemi
\n
\nDhe tani nj\u00eb p\u00ebrdorues i zakonsh\u00ebm do ta shoh\u00eb k\u00ebt\u00eb, n\u00ebse p\u00ebrpiqet t\u00eb p\u00ebrdor\u00eb Get-NetUser n\u00eb PowerView:<\/p>\n

\"Problemi
\n
\nMunda t\u00eb fsheh informacionin e dobish\u00ebm nga syt\u00eb e t\u00eb tjer\u00ebve. P\u00ebr t\u00eb mbajtur aksesin p\u00ebr p\u00ebrdoruesit p\u00ebrkat\u00ebs, krijova nj\u00eb ACL tjet\u00ebr p\u00ebr t'i lejuar an\u00ebtar\u00ebt e grupit VIP (Cruella dhe koleg\u00ebt e saj t\u00eb lart\u00eb) t\u00eb ken\u00eb akses n\u00eb k\u00ebto t\u00eb dh\u00ebna konfidenciale. N\u00eb fjal\u00eb t\u00eb tjera, realizova nd\u00ebshkimet AD mbi nj\u00eb model roli, q\u00eb e b\u00ebri informacionin e ndjesh\u00ebm t\u00eb pap\u00ebrfilur p\u00ebr shumic\u00ebn e punonj\u00ebsve, duke p\u00ebrfshir\u00eb insajder\u00ebt.<\/p>\n

Megjithat\u00eb, mund t\u00eb b\u00ebni an\u00ebtar\u00ebsimin n\u00eb grup t\u00eb paduksh\u00ebm p\u00ebr p\u00ebrdoruesit duke vendosur p\u00ebrkat\u00ebsisht ACL p\u00ebr objektin e grupit n\u00eb AD. Kjo do t\u00eb ndihmoj\u00eb n\u00eb aspektin e privat\u00ebsis\u00eb dhe siguris\u00eb.<\/p>\n

N\u00eb t\u00eb tij serit\u00eb e testimeve epike<\/a><\/noindex> Un\u00eb tregova se si t\u00eb l\u00ebvizni n\u00eb sistem duke studiuar an\u00ebtar\u00ebsimin n\u00eb grupe me PowerViews Get-NetGroupMember. N\u00eb skenarin tim, un\u00eb kufizova aksesin p\u00ebr t\u00eb lexuar n\u00eb an\u00ebtar\u00ebsimin e nj\u00eb grupi t\u00eb caktuar. Ju shihni rezultatet e ekzekutimit t\u00eb komand\u00ebs para dhe pas ndryshimeve:<\/p>\n

\"Problemi
\n
\nArrit\u00ebm t\u00eb fshehim an\u00ebtar\u00ebsimin e Cruella dhe Monty Burns n\u00eb grupin VIP, duke e b\u00ebr\u00eb m\u00eb t\u00eb v\u00ebshtir\u00eb p\u00ebr haker\u00ebt dhe insajder\u00ebt t\u00eb eksplorojn\u00eb infrastruktur\u00ebn.<\/p>\n

Ky postim ishte i destinuar p\u00ebr t'ju motivuar t\u00eb shqyrtoni m\u00eb me kujdes fushat
\nAD dhe lejet e lidhura me t\u00eb. AD \u00ebsht\u00eb nj\u00eb burim i shk\u00eblqyer, por mendoni si do t\u00eb
\ndonit t\u00eb ndani informacione t\u00eb besueshme dhe t\u00eb dh\u00ebna personale, ve\u00e7an\u00ebrisht,
\nkur b\u00ebhet fjal\u00eb p\u00ebr ata q\u00eb q\u00ebndrojn\u00eb n\u00eb krye t\u00eb organizat\u00ebs suaj. \u00a0
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PowerView \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0435\u0433\u043e \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u0445 \u0438\u0437 Active Directory (\u0434\u0430\u043b\u0435\u0435 \u2013 AD). \u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u044f \u0434\u0435\u043b\u0430\u043b \u0430\u043a\u0446\u0435\u043d\u0442 \u043d\u0430 \u0441\u0431\u043e\u0440\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0447\u043b\u0435\u043d\u0441\u0442\u0432\u0435 \u0432 \u0433\u0440\u0443\u043f\u043f\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u044d\u0442\u0443 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0447\u0442\u043e\u0431\u044b \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u0441\u0435\u0442\u0438. \u0412 \u043b\u044e\u0431\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435, AD \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u0445, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53879","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Problemi i privat\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave n\u00eb Active Directory | ProHoster","description":"Isha angazhuar n\u00eb testime mbi.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 Active Directory | ProHoster","og:description":"\u042f \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0441\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/problema-konfidentsialnosti-dannyh-v-active-directory","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53879","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:08:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:08:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53879","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=53879"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53879\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=53879"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=53879"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=53879"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}