mirror of
https://github.com/subat0mik/Misconfiguration-Manager
synced 2026-06-08 17:38:34 +00:00
Specified which attack requirements are defaults
This commit is contained in:
Duane Michael
@@ -8,11 +8,11 @@ Request computer policy and deobfuscate secrets
|
||||
- [T1555](https://attack.mitre.org/techniques/T1555/) - Passwords from Password Stores
|
||||
|
||||
## Requirements
|
||||
- PKI certificates are not required for client authentication
|
||||
- PKI certificates are not required for client authentication [DEFAULT]
|
||||
|
||||
AND
|
||||
|
||||
- Domain computer account credentials or (`MachineAccountQuota` > `0` and `Add workstations to domain` includes `Domain Users`)
|
||||
- Domain computer account credentials or (`MachineAccountQuota` > `0` and `Add workstations to domain` includes `Domain Users` [DEFAULT])
|
||||
|
||||
## Summary
|
||||
The [network access account](https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/accounts#network-access-account) (NAA) is a domain account that can be configured on the site server. Clients use the NAA to access and retrieve software from a distribution point but serves no other purpose on the client. The credentials are retrieved by clients as part of the Computer Policy. Upon receipt, the client will encrypt the NAA using the Data Protection API (DPAPI). But what happens before that? How are the secrets protected in transit before the client protects them with DPAPI?
|
||||
|
||||
@@ -16,21 +16,21 @@ NTLM relay site server to SMB on site systems
|
||||
- ELEVATE-1.2: Passive site server
|
||||
- Connectivity from the coercion target to SMB (TCP/445) on the relay server
|
||||
- Coercion target settings:
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or = `X` and `DCAllowedNTLMServers` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0` or not present, or = `1` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or = `X` and `DCAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0` or not present, or = `1` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Relay target settings:
|
||||
- Connectivity from the relay server to SMB (TCP/445) on the relay target
|
||||
- `RequireSecuritySignature` = `0` or not present
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- `RequireSecuritySignature` = `0` or not present [DEFAULT]
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Coercion target is local admin (to access RPC/admin shares)
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
SCCM uses the site system installation account to install and maintain roles on new or existing site system servers. By default, this account is the site server's domain compuper account and requires [local administrator permissions](https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/accounts#site-system-installation-account) for and network access to the target systems. An attacker could coerce NTLM authentication from the site server's domain computer account and relay it to SMB on remote site systems in the same site to move laterally and elevate privileges.
|
||||
|
||||
@@ -17,22 +17,22 @@ NTLM relay via automatic client push installation
|
||||
- Automatic site-wide client push installation is enabled
|
||||
- Automatic site assignment is enabled
|
||||
- `Allow connection fallback to NTLM` is enabled for client push installation
|
||||
- PKI certificates are not required for client authentication
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- Domain computer account is not in `Protected Users`
|
||||
- PKI certificates are not required for client authentication [DEFAULT if installation version < 2103 OR KB15599094 is not installed]
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain computer account is not in `Protected Users` [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Relay target settings:
|
||||
- Connectivity from the relay server to SMB (TCP/445) on the relay target
|
||||
- `RequireSecuritySignature` = `0` or not present
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- `RequireSecuritySignature` = `0` or not present [DEFAULT]
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Coercion target is local admin (to access RPC/admin shares)
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
When SCCM automatic site assignment and automatic client push installation are enabled, and PKI certificates aren’t required for client authentication, it’s possible to coerce NTLM authentication from the site server's installation and machine accounts to an arbitrary NetBIOS name, FQDN, or IP address, allowing the credentials to be relayed or cracked. This can be done using a low-privileged domain account on any Windows system.
|
||||
|
||||
@@ -15,25 +15,25 @@ Coerce NTLM relay via automatic client push installation and AD System Discovery
|
||||
- Ability to create a DNS A record
|
||||
- Connectivity from the primary site server to SMB (TCP/445) on the relay server
|
||||
- Primary site server settings:
|
||||
- Automatic site-wide client push installation is enabled
|
||||
- Automatic site assignment is enabled
|
||||
- AD System Discovery is enabled with newly created computer accounts within search path or below if search resursive child objects is enabled.
|
||||
- `Allow connection fallback to NTLM` is enabled for client push installation or Hotfix KB15599094 is missing on older SCCM deployments
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- Domain computer account is not in `Protected Users`
|
||||
- Automatic site-wide client push installation is enabled [NON-DEFAULT]
|
||||
- Automatic site assignment is enabled [DEFAULT]
|
||||
- AD System Discovery is enabled with newly created computer accounts within search path or below if search resursive child objects is enabled. [NON-DEFAULT]
|
||||
- `Allow connection fallback to NTLM` is enabled for client push installation or Hotfix KB15599094 is missing on older SCCM deployments [DEFAULT if installation version < 2103 OR KB15599094 is not installed]
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain computer account is not in `Protected Users` [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Relay target settings:
|
||||
- Connectivity from the relay server to SMB (TCP/445) on the relay target
|
||||
- `RequireSecuritySignature` = `0` or not present
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- `RequireSecuritySignature` = `0` or not present [DEFAULT]
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Coercion target is local admin (to access RPC/admin shares)
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
When SCCM automatic site assignment, automatic client push installation, and AD System Discovery are enabled, and newly created computer accounts are within the system discovery search path, it’s possible to coerce NTLM authentication from the site server's installation and machine accounts to an arbitrary NetBIOS name, FQDN, or IP address, allowing the credentials to be relayed or cracked. This can be done using a low-privileged domain account if the default configuration is present which allows every domain user to create DNS records and join up to 10 computer accounts to AD.
|
||||
|
||||
@@ -17,18 +17,18 @@ Hierarchy takeover via NTLM coercion and relay to MSSQL on remote site database
|
||||
- TAKEOVER-1.3: Coerce passive site server
|
||||
- Connectivity from the coercion target to SMB (TCP/445) on the relay server
|
||||
- Coercion target settings:
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- Domain computer account is not in `Protected Users`
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain computer account is not in `Protected Users` [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Connectivity from the relay server to MSSQL (TCP/1433) on the relay target, the site database
|
||||
- Extended protection for authentication not required on the site database
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
By default, the Active Directory domain computer accounts for primary site servers (including CAS site servers), systems hosting the SMS Provider role, and passive site servers are granted the `db_owner` role in their respective site's MSSQL database. An attacker who is able to successfully coerce NTLM authentication from one of these accounts and relay it to the site database can use these permissions to grant an arbitrary domain account the SCCM "Full Administrator" role.
|
||||
|
||||
@@ -16,21 +16,21 @@ Hierarchy takeover via NTLM coercion and relay to SMB on remote site database
|
||||
- TAKEOVER-2.2: Coerce passive site server
|
||||
- Connectivity from the coercion target to SMB (TCP/445) on the relay server
|
||||
- Coercion target settings:
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- Domain computer account is not in `Protected Users`
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain computer account is not in `Protected Users` [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Connectivity from the relay server to SMB (TCP/445) on the relay target, the site database
|
||||
- Relay target settings:
|
||||
- `RequireSecuritySignature` = `0` or not present
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- `RequireSecuritySignature` = `0` or not present [DEFAULT]
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Coercion target is local admin (to access RPC/admin shares)
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
|
||||
## Summary
|
||||
|
||||
@@ -17,24 +17,24 @@ Hierarchy takeover via NTLM coercion and relay to HTTP on AD CS
|
||||
- TAKEOVER-3.4: Coerce site database server
|
||||
- Connectivity from the coercion target to SMB (TCP/445) on the relay server (or WebClient enabled and connectivity via any port)
|
||||
- Coercion target settings:
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- Domain computer account is not in `Protected Users`
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain computer account is not in `Protected Users` [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Either of the following AD CS services is in use:
|
||||
- Certificate Authority Web Enrollment
|
||||
- Certificate Enrollment Web Service
|
||||
- Certificate Authority Web Enrollment [NON-DEFAULT]
|
||||
- Certificate Enrollment Web Service [NON-DEFAULT]
|
||||
- Connectivity from the relay server to HTTPS (TCP/443) on the relay target hosting the AD CS service
|
||||
- Extended protection for authentication is not required by the target AD CS service
|
||||
- Extended protection for authentication is not required by the target AD CS service [DEFAULT]
|
||||
- An enabled AD CS template that allows enrollment and supports authentication
|
||||
- Relay target settings:
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
When available, SCCM uses public key infrastructure (PKI) for authentication and authorization. While not required, administrators may choose to deploy Active Directory Certificate Services (AD CS) to support SCCM's [various certificate requirements](https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/plan-for-certificates) rather than use self-signed certificates. AD CS is home to its own [misconfigurations](https://posts.specterops.io/certified-pre-owned-d95910965cd2); particularly ESC8. In short, the [certificate enrollment web interface](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831649(v=ws.11)) is vulnerable to NTLM relaying. An attacker may coerce NTLM authentication from a coercion target and relay to the AD CS enrollment web service to enroll in and acquire a valid certificate template on behalf of the target. The template can then be used to escalate to "Full Administrator" in SCCM by impersonating the coerced target.
|
||||
|
||||
@@ -14,11 +14,11 @@ Hierarchy takeover via NTLM coercion and relay from CAS to origin primary site s
|
||||
- Connectivity to SMB (TCP/445) on coercion target:
|
||||
- Connectivity from the coercion target to SMB (TCP/445) on the relay server
|
||||
- Coercion target settings:
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- Domain computer account is not in `Protected Users`
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain computer account is not in `Protected Users` [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Connectivity from the relay server to SMB (TCP/445) on the relay target, the child primary site
|
||||
@@ -30,12 +30,12 @@ Hierarchy takeover via NTLM coercion and relay from CAS to origin primary site s
|
||||
AND
|
||||
|
||||
- Relay target settings:
|
||||
- `RequireSecuritySignature` = `0` or not present
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- `RequireSecuritySignature` = `0` or not present [DEFAULT]
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Coercion target is local admin (to access RPC/admin shares)
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
In some situations, such as reaching limits for [client enrollment](https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/configs/size-and-scale-numbers#bkmk_pri), SCCM adminsitrators may choose to expand from single site into a hierarchy managed by a central administration site (CAS). A prerequisite for expansion is for the CAS's domain computer account to be a [local administrator](https://learn.microsoft.com/en-us/mem/configmgr/core/servers/deploy/install/prerequisites-for-installing-sites#computer-account-as-administrator) on the originating primary site server. This permission is only required during expansion of the site and can be removed when complete. Additionally, this permission is not required for any further sites joined to the hierarchy once complete. However, if a configuration exists where all site server hosts are a member of a security group that grants local administrator rights to each other, the CAS can be coerced and relayed to *any* child site.
|
||||
|
||||
@@ -16,16 +16,16 @@ Hierarchy Takeover via NTLM coercion and relay to AdminService on remote SMS Pro
|
||||
- TAKEOVER-5.2: Coerce passive site server
|
||||
- Connectivity from the coercion target to SMB (TCP/445) on the relay server
|
||||
- Coercion target settings:
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Connectivity from the relay server to HTTPS (TCP/443) on the relay target hosting the SMS Provider role
|
||||
- Relay target domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
The SMS Provider is a SCCM site server role installed by default on the site server when configuring a primary site or central administration site. The role can optionally be installed on additional SCCM site systems for high availability configurations. The SMS Provider is a Windows Management Instrumentation (WMI) provider that performs as an intermediary for accessing and modifying data stored in the site database. Access to the SMS Provider is controlled via membership of the the `SMS Admins` local security group on each site server. The site server computer account is a member of the `SMS Admins` security group on each SMS Provider in a site by default.
|
||||
|
||||
@@ -17,20 +17,20 @@ Hierarchy takeover via NTLM coercion and relay to SMB on remote SMS Provider
|
||||
- TAKEOVER-6.2: Coerce passive site server
|
||||
- Connectivity from the coercion target to SMB (TCP/445) on the relay server
|
||||
- Coercion target settings:
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Connectivity from the relay server to SMB (TCP/445) on the relay target
|
||||
- Relay target settings:
|
||||
- `RequireSecuritySignature` = `0` or not present
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- `RequireSecuritySignature` = `0` or not present [DEFAULT]
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Coercion target is local admin (to access RPC/admin shares)
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
The SMS Provider is a SCCM site server role installed by default on the site server when configuring a primary site or central administration site. The role can optionally be installed on additional SCCM site systems for high availability configurations. The SMS Provider is a Windows Management Instrumentation (WMI) provider that performs as an intermediary for accessing and modifying data stored in the site database. An attacker who is able to successfully coerce NTLM authentication from a site server can escalate to "Full Administrator" by elevating to "NT\AUTHORITY SYSTEM" on the SMS Provider.
|
||||
|
||||
@@ -16,21 +16,21 @@ Hierarchy Takeover via NTLM coercion and relay to SMB between primary and passiv
|
||||
- TAKEOVER-7.2: Coerce passive site server
|
||||
- Connectivity from the coercion target to SMB (TCP/445) on the relay server
|
||||
- Coercion target settings:
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Connectivity from the relay server to SMB on target host
|
||||
- SMS Provider role installed on target preferred (default) but not required
|
||||
- Relay target settings:
|
||||
- `RequireSecuritySignature` = `0` or not present
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- `RequireSecuritySignature` = `0` or not present [DEFAULT]
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Coercion target is local admin (to access RPC/admin shares)
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
## Summary
|
||||
For high availability configurations, the passive site server role is deployed to SCCM sites where redundancy for the site server role is required. A passive site server shares the same configuration and privileges as the active site server yet performs no writes or changes to the site until promoted manually or during an automated failover.
|
||||
|
||||
@@ -17,28 +17,28 @@ Hierarchy takeover via NTLM coercion and relay HTTP to LDAP on domain controller
|
||||
- Connectivity from the coercion target to any port on the relay server
|
||||
- The relay server is in the intranet zone and has a valid NetBIOS name or FQDN (e.g., via ADIDNS poisoning if using a network implant)
|
||||
- Coercion target settings:
|
||||
- The `WebClient` service is installed and started
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server
|
||||
- Domain computer account is not `is sensitive and cannot be delegated`
|
||||
- The `WebClient` service is installed and started [INSTALLED BY DEFAULT ON WINDOWS WORKSTATIONS]
|
||||
- `BlockNTLM` = `0` or not present, or = `1` and `BlockNTLMServerExceptionList` contains attacker relay server [DEFAULT]
|
||||
- `RestrictSendingNTLMTraffic` = `0`, `1`, or not present, or = `2` and `ClientAllowedNTLMServers` contains attacker relay server [DEFAULT]
|
||||
- Domain computer account is not `is sensitive and cannot be delegated` [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains coercion target [DEFAULT]
|
||||
|
||||
### Relay
|
||||
- Connectivity from the relay server to LDAP or LDAPS on the relay target, the domain controller
|
||||
- Relay target settings:
|
||||
- Either LDAP signing or channel binding is not required on the domain controller
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present
|
||||
- Either LDAP signing or channel binding is not required on the domain controller [DEFAULT]
|
||||
- `RestrictReceivingNTLMTraffic` = `0` or not present [DEFAULT]
|
||||
- Domain controller settings:
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target
|
||||
- `RestrictNTLMInDomain` = `0` or not present, or is configured with any value and `DCAllowedNTLMServers` contains relay target [DEFAULT]
|
||||
- `LmCompatibilityLevel` < `5` or not present, or = `5` and LmCompatibilityLevel >= `3` on the coercion target [DEFAULT]
|
||||
|
||||
- For resource-based constrained delegation:
|
||||
- Control of an account's SPN
|
||||
|
||||
OR
|
||||
|
||||
- `MachineAccountQuota` > `0` and domain users permitted to add computer accounts
|
||||
- `MachineAccountQuota` > `0` and domain users permitted to add computer accounts [DEFAULT]
|
||||
|
||||
## Summary
|
||||
An attacker who is able to successfully coerce NTLM authentication from the Active Directory domain computer account for a primary site server, system hosting the SMS Provider role, or passive site server via HTTP and relay it to LDAP on a domain controller can conduct resource-based constrained delegation (RBCD) or shadow credentials attacks to compromise the server, then connect to:
|
||||
|
||||
Reference in New Issue
Block a user