Sean Metcalf

I improve security for enterprises around the world working for TrustedSec & I am @PyroTek3 on Twitter. Read the About page (top left) for information about me. :) https://adsecurity.org/?page_id=8

Author's posts

Oct 11 2018

From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration

By Sean Metcalf in ActiveDirectorySecurity, Microsoft Security, Technical Reference

It’s been almost 1.5 years since the Medium post by Shay Ber was published that explained how to execute a DLL as SYSTEM on a Domain Controller provided the account is a member of DNSAdmins. I finally got around to posting here since many I speak with aren’t aware of this issue. Shay describes this …

Active Directory, DNS server object permission, DNSAdmins, DnsPluginCleanup, DnsPluginInitialize, DnsPluginQuery, Domain Controller, from DNSAdmin to Domain Admin, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll, mimikatz dll, run DLL on Domain Controller, ServerLevelPluginDll, UUID is 50ABC2A4–574D-40B3–9D66-EE4FD5FBA076, \PIPE\DNSSERVER

Oct 10 2018

Domain Controller Print Server + Unconstrained Kerberos Delegation = Pwned Active Directory Forest

By Sean Metcalf in ActiveDirectorySecurity, Exploit, Hacking, Microsoft Security, Security Conference Presentation/Video

At DerbyCon 8 (2018) over the weekend Will Schroeder (@Harmj0y), Lee Christensen (@Tifkin_), & Matt Nelson (@enigma0x3), spoke about the unintended risks of trusting AD. They cover a number of interesting persistence and privilege escalation methods, though one in particular caught my eye. Overview Lee figured out and presents a scenario where there’s an account …

AD credential theft, constrained delegation, DCSync, delegation, DoD STIG, Domain Controller Spooler, Kerberos, Kerberos attack, Kerberos Delegation, Kerberos unconstrained delegation, MS-RPRN, Print Spooler, RpcRemoteFindFirstPrinterChangeNotification, Spooler, Spooler Service

Aug 12 2018

Black Hat & DEF CON Presentation Slides Posted

By Sean Metcalf in Security Conference Presentation/Video, Vulnerability

I just uploaded the slides from my Black Hat & DEF CON talks from the past week in Vegas. They are a bit different with the BH talk more Blue (defensive) and the DC talk mostly Red (Offensive) in focus. Also note that the only real overlap in content is the MFA & password vault …

May 20 2018

NolaCon (2018) Active Directory Security Talk Slides Posted

By Sean Metcalf in ActiveDirectorySecurity, Security Conference Presentation/Video

I recently presented my talk “Active Directory Security: The Journey” at Nolacon in New Orleans, LA. Slides are now posted here. On Sunday, May 19th, 2018, I spoke at NolaCon at 11am. Here’s the talk description: Active Directory is only the beginning. Attackers have set their sights squarely on Active Directory when targeting a company, though …

Jan 01 2018

Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory

By Sean Metcalf in ActiveDirectorySecurity, Hacking, Microsoft Security

I have been fascinated with Read-Only Domain Controllers (RODCs) since RODC was released as a new DC promotion option with Windows Server 2008. Microsoft customers wanted a DC that wasn’t really a DC. – something that could be deployed in a location that’s not physically secure and still be able to authenticate users. This post …

Allowed RODC Password Replication Policy, DCSync, Denied RODC Password Replication Policy, Directory Services Restore Mode password, discovering RODCs, Domain Controller, DSRM, golden ticket, Hacking RODCs, harden Read-Only Domain Controllers, harden RODCs, Invoke-Mimikatz, KRBTGT, KRBTGT_######, mimikatz, msDS-AuthenticatedToAccountList, msDS-KeyVersionNumber, msDS-NeverRevealGroup, msDS-Reveal-OnDemandGroup, msDS-RevealedList, Read-Only Domain Controller, ReadOnly Domain Controller, RODC, RODC Active Directory, RODC Administration, RODC administrators, RODC backlink, RODC golden ticket, RODC in the DMZ, RODC Krbtgt, RODC ManagedBy attribute, RODC Manager, RODC password, RODC Password Replication Policy, RODC replication, RODC security, RODC SYSVOL, Silver Tickets

Nov 24 2017

Securing Microsoft Active Directory Federation Server (ADFS)

By Sean Metcalf in Cloud Security, Microsoft Security, Security Recommendation, Technical Reading, Technical Reference

Many organizations are moving to the cloud and this often requires some level of federation. Federation, put simply, extends authentication from one system (or organization) to another. Gerald Steere (@Darkpawh) and I spoke about cloud security at DEF CON in July 2017. Presentation slides and video are here: “Hacking the Cloud” One of the key …

ADFS certificates, ADFS Recommendations, ADFS Security, ADFS Security Best Practices, GoldenSAML, GoldenSAML Detection, GoldenSAML protection, Microsoft Active Directory Federation Servers, Protecting ADFS, Securing ADFS

Aug 11 2017

Gathering AD Data with the Active Directory PowerShell Module

By Sean Metcalf in PowerShell, Technical Reference

Microsoft provided several Active Directory PowerShell cmdlets with Windows Server 2008 R2 (and newer) which greatly simplify tasks which previously required putting together lengthy lines of code involving ADSI. On a Windows client, install the Remote Sever Administration Tools (RSAT) and ensure the Active Directory PowerShell module is installed. On a Windows server (2008 R2 …

Active Directory PowerShell Module, Active Directory Trusts, AD cmdlets, AD PowerShell cmdlets, Add-WindowsFeature RSAT-AD-PowerShell, ADSI, Backup domain GPOs, Enumerate Domain Trusts, Find AD Kerberos Service Accounts, Finding Active Directory Flexible Master Single Operation (FSMO) Roles, Get AD site information., Get-ADComputer, Get-ADDomain, Get-ADDomainController, Get-ADForest, Get-ADGroup, Get-ADGroupMember, Get-ADReplicationPartnerFailure, Get-ADReplicationPartnerMetadata, Get-ADReplicationUptodatenessVectorTable, Get-ADUser, Get-Command -module ActiveDirectory, Get-Module -ListAvailable, Get-RootDSE, Import-Module ServerManager, Inventory Domain Controllers, PowerShell, PowerShell Find inactive computers, PowerShell Find inactive users

Aug 10 2017

Beyond Domain Admins – Domain Controller & AD Administration

By Sean Metcalf in ActiveDirectorySecurity, Microsoft Security, Technical Reference

Active Directory has several levels of administration beyond the Domain Admins group. In a previous post, I explored: “Securing Domain Controllers to Improve Active Directory Security” which explores ways to better secure Domain Controllers and by extension, Active Directory. For more information on Active Directory specific rights and permission review my post “Scanning for Active …

Active Directory Admins, Active Directory groups, Active Directory Security, ActiveDirectory, AD Administrators, AD Admins, AD Security, allow log on locally, Back-up files & directories, Backup Operators, Builtin, DC rights, DCSync, Default AD groups, Default Domain Controller Policy, domain Administrators group, Domain Admins, Domain Controller, Domain Controller groups, Domain Controller rights, Enable computer and user accounts to be trusted for delegation, Force shutdown from a remote system, Get-ADGroupMember, Log on as a batch job, Log on as a service, Manage auditing and security log, Print Operators, Remote Desktop users, Restore files & directories, Schema Admins, Server Operators, Synchronize directory service data

Jun 14 2017

Scanning for Active Directory Privileges & Privileged Accounts

By Sean Metcalf in ActiveDirectorySecurity, Microsoft Security

Active Directory Recon is the new hotness since attackers, Red Teamers, and penetration testers have realized that control of Active Directory provides power over the organization. I covered ways to enumerate permissions in AD using PowerView (written by Will @harmj0y) during my Black Hat & DEF CON talks in 2016 from both a Blue Team …

Account Operators, Active Directory permissions, Active Directory PRivileged Access, Active Directory Security, AD, AD ACLs, AD Delegation, AD groups in Local Groups, AD Security, AdminSDHolder, Allow logon locally, Allow logon over Remote Desktop Services, Backup Operators, Bloodhound, Create GPO rights, CreateChild, DCSync, DeleteChild, Domain Admins, Enable computer and user accounts to be trusted for delegation, Enterprise Admins, Extended Right, Full Control, GenericAll, GenericWrite, GPO, Greoup Policy Delegation, Group Membership, Group Policy Object, Group Policy Permission, Impersonate a client after authentication, Link GPO rights, Manage auditing and security log, Manage Group Policy link, PowerView, Print Operators, Replicating Directory Changes All, Restricted Groups, S-1-5--512, S-1-5--517, S-1-5--520, S-1-5-21--1102, S-1-5-21--519, S-1-5-21--525, S-1-5-21--571, S-1-5-32--574, S-1-5-32-544, S-1-5-32-548, S-1-5-32-550, S-1-5-32-551, S-1-5-32-554, S-1-5-32-562, S-1-5-32-573, S-1-5-32-578, SACL, Schema Admins, SDDL, SDProp, Self, SeMachineAccountPrivilege, SeNetworkLogonRight, SeTcbPrivilege, SeTrustedCredManAccessPrivilege, SIDHistory, Synchronize directory service data, User Rights Assignments, Validated Write, WriteDACL, WriteOwner, WritePRoperty

May 30 2017

AD Reading: Windows Server 2016 Active Directory Features

By Sean Metcalf in Technical Reference

The following are useful resources for Windows Server 2016 Active Directory Features. Windows 2016 Features What’s New in Windows 2016 Active Directory Windows Server 2016 AD Functional Level Privileged Access Management (PAM) Windows 2016 PAM Shadow Security Principals (temporary group membership) Azure AD Join Windows 2016 Azure AD Join Microsoft Hello …

Sean Metcalf

Author's posts

From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration

Domain Controller Print Server + Unconstrained Kerberos Delegation = Pwned Active Directory Forest

Black Hat & DEF CON Presentation Slides Posted

NolaCon (2018) Active Directory Security Talk Slides Posted

Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory

Securing Microsoft Active Directory Federation Server (ADFS)

Gathering AD Data with the Active Directory PowerShell Module

Beyond Domain Admins – Domain Controller & AD Administration

AD Reading: Windows Server 2016 Active Directory Features

Recent Posts

Active Directory & Entra ID Security Services

Popular Posts

Categories

Recent Posts

Recent Comments

Archives

Categories

Meta

Copyright

Sean Metcalf

Author's posts

Recent Posts

Active Directory & Entra ID Security Services

Popular Posts

Categories

Tags

Recent Posts

Recent Comments

Archives

Categories

Meta

Copyright