{"id":33708,"date":"2019-10-31T21:54:17","date_gmt":"2019-10-31T18:54:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena\/"},"modified":"2019-10-31T21:54:17","modified_gmt":"2019-10-31T18:54:17","slug":"uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","title":{"rendered":"S\u00e5rbarhet i Exchange: hur man uppt\u00e4cker privilegierad h\u00f6jning till dom\u00e4nadministrat\u00f6r","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Uppt\u00e4ckt i \u00e5r s\u00e5rbarhet i Exchange<\/a><\/noindex> m\u00f6jligg\u00f6r f\u00f6r vilken dom\u00e4nanv\u00e4ndare som helst att f\u00e5 dom\u00e4nadministrat\u00f6rsbeh\u00f6righet och kompromettera Active Directory (AD) samt andra anslutna v\u00e4rdar. I dag kommer vi att ber\u00e4tta hur denna attack fungerar och hur man kan uppt\u00e4cka den. <\/p>\n

\"S\u00e5rbarhet
\n<\/a><\/noindex>
\n S\u00e5 h\u00e4r fungerar attacken:<\/b><\/p>\n

    \n
  1. Angriparen tar \u00f6ver ett konto fr\u00e5n vilken dom\u00e4nanv\u00e4ndare som helst med en aktiv e-postl\u00e5da, f\u00f6r att prenumerera p\u00e5 push-notiser fr\u00e5n Exchange.<\/li>\n
  2. Angriparen anv\u00e4nder NTLM-rel\u00e4 f\u00f6r att lura Exchange-servern: i slut\u00e4ndan ansluter Exchange-servern till datorn med den komprometterade anv\u00e4ndaren via NTLM \u00f6ver HTTP, som angriparen sedan anv\u00e4nder f\u00f6r att genomf\u00f6ra autentisering p\u00e5 dom\u00e4nkontrollanten via LDAP med Exchange-kontoinformationen.<\/li>\n
  3. Som resultat anv\u00e4nder angriparen dessa Exchange-kontobeh\u00f6righeter f\u00f6r att h\u00f6ja sina egna privilegier. Detta sista steg kan ocks\u00e5 utf\u00f6ras av en fientligt inst\u00e4lld administrat\u00f6r som redan har legitimerad \u00e5tkomst f\u00f6r att genomf\u00f6ra n\u00f6dv\u00e4ndiga r\u00e4ttighets\u00e4ndringar. Genom att skapa en regel f\u00f6r att uppt\u00e4cka denna aktivitet skyddar du dig mot denna och liknande attacker.<\/li>\n<\/ol>\n

    \nSom ett resultat kan angriparen exempelvis starta DCSync f\u00f6r att h\u00e4mta hashade l\u00f6senord f\u00f6r alla dom\u00e4nanv\u00e4ndare. Detta g\u00f6r det m\u00f6jligt f\u00f6r honom att genomf\u00f6ra olika typer av attacker \u2014 fr\u00e5n golden ticket-attacker till hash-\u00f6verf\u00f6ring.<\/p>\n

    Forskningsgruppen Varonis har noggrant studerat denna attackvektor och f\u00f6rberett en v\u00e4gledning f\u00f6r v\u00e5ra kunder f\u00f6r att uppt\u00e4cka den samt kontrollera om de redan har blivit komprometterade.<\/p>\n

    Uppt\u00e4ckte privilegierad h\u00f6jning i dom\u00e4nen<\/b><\/h2>\n

    \nI DatAlert<\/a><\/noindex> skapa en anpassad regel f\u00f6r att sp\u00e5ra \u00e4ndringar i specifika objektsbeh\u00f6righeter. Denna regel kommer att aktiveras vid till\u00e4gg av r\u00e4ttigheter och beh\u00f6righeter f\u00f6r objektet i dom\u00e4nen:<\/p>\n

      \n
    1. Ange regelnamn<\/li>\n
    2. St\u00e4ll in kategorin som 'Privilegievandring' <\/li>\n
    3. Ange v\u00e4rdet f\u00f6r resurstypen 'Alla typer av resurser' <\/li>\n
    4. Filserver = DirectoryServices <\/li>\n
    5. Ange den dom\u00e4n du \u00e4r intresserad av, till exempel efter namn <\/li>\n
    6. L\u00e4gg till ett filter f\u00f6r till\u00e4gg av beh\u00f6righeter p\u00e5 AD-objektet <\/li>\n
    7. Och gl\u00f6m inte att l\u00e4mna alternativet 'S\u00f6k i underordnade objekt' oavmarkerat <\/li>\n<\/ol>\n

      \n\"S\u00e5rbarhet
      \n<\/p>\n

      Och nu rapporten: uppt\u00e4ckten av \u00e4ndrade r\u00e4ttigheter p\u00e5 dom\u00e4nobjektet <\/b><\/h2>\n

      \n\u00c4ndringar av beh\u00f6righeter p\u00e5 AD-objekt \u00e4r ganska s\u00e4llsynta, s\u00e5 allt som har orsakat denna varning beh\u00f6ver och b\u00f6r utredas. Det skulle ocks\u00e5 vara bra att testa utseendet och inneh\u00e5llet i rapporten innan regeln aktiveras.<\/p>\n

      Den h\u00e4r rapporten kommer ocks\u00e5 att visa om du redan har blivit komprimerad av denna attack:<\/p>\n

      \"S\u00e5rbarhet
      \n
      \nEfter aktivering av regeln kan alla andra privilegief\u00f6rh\u00f6jningsh\u00e4ndelser unders\u00f6kas via DatAlert:s webbgr\u00e4nssnitt:<\/p>\n

      \"S\u00e5rbarhet
      \n
      \nEfter att ha konfigurerat denna regel kan du \u00f6vervaka och skydda dig mot dessa och liknande typer av s\u00e5rbarheter i s\u00e4kerhetssystemet, unders\u00f6ka h\u00e4ndelser med AD-katalogtj\u00e4nstobjekt och kontrollera om du \u00e4r utsatt f\u00f6r denna kritiska s\u00e5rbarhet.
      \n
      K\u00e4lla:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c Active Directory (AD) \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430 \u0438 \u043a\u0430\u043a \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c. \u0412\u043e\u0442 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u044d\u0442\u0430 \u0430\u0442\u0430\u043a\u0430: \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0432\u043b\u0430\u0434\u0435\u0432\u0430\u0435\u0442 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0441 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u043c \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c \u044f\u0449\u0438\u043a\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-33708","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Exchange-s\u00e5rbarhet: hur man uppt\u00e4cker privilegief\u00f6rh\u00f6jningar till dom\u00e4nadministrat\u00f6r | ProHoster","description":"Den s\u00e5rbarhet i Exchange som uppt\u00e4cktes i \u00e5r till\u00e5ter varje dom\u00e4nanv\u00e4ndare att f\u00e5.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Exchange: \u043a\u0430\u043a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exchange \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0434\u043e\u043c\u0435\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/uyazvimost-exchange-kak-obnaruzhit-povyshenie-privilegij-do-administratora-domena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:54:17+00:00","article:modified_time":"2019-10-31T18:54:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33708","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 16:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:14:52","updated":"2026-01-21 16:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/33708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=33708"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/33708\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/25390"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=33708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=33708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=33708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}