Share this page!

Stephan Berger Profile picture
Twitter logo
Mar 13 • 8 tweets • 4 min read
1/ Number #8 of the #ActiveDirectory hardening measures:

Print Spooler Service

🧵 #CyberSecurity
2/ A running print spooler service on domain controllers is still a relatively common finding in our AD assessments, even though an attack path via spooler service and unconstrained delegations have been known for years. [1]

Screenshot below from #PingCastle (@mysmartlogon)
3/ Apart from the (older) attack technique with unconstrained delegations (see above), the printer spooler has had various critical vulnerabilities over the last two years. [3]
4/ In a recent incident response investigation, the attacker attempted to exploit the PrintNightmare (CVE-2021-34527) vulnerability.

5/ PrintNightmare can be used for LPE and RCE, as the screenshot below shows. [2]
6/ Disable the print spooler service on domain controllers if possible to reduce the attack risk in case of an active attacker in the network.
7/ Additionally, the corresponding Windows patches (as an example for the LPE via PrintNightmware) must be rolled out and installed quickly across the board.
8/ References:

[1] adsecurity.org/?p=4056
[2] github.com/m8sec/CVE-2021…
[3] cisa.gov/known-exploite…

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Stephan Berger

Stephan Berger Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @malmoeb

Stephan Berger Profile picture
Mar 12
1/ Number #7 of the #ActiveDirectory hardening measures:

Harden critical accounts

🧵 #CyberSecurity
2/ To raise the bar again, add critical accounts to the Protected Users Security Group.

"This group provides protections over and above just preventing delegation and makes them even more secure; however, it may cause operational issues, so it is worth testing in your env." [2]
3/ Benefits:

1⃣ Credential delegation (CredSSP) will not cache the user's plain text credentials [..]

2⃣ Beginning with Windows 8.1 and Windows Server 2012 R2, Windows Digest will not cache the user's plain text credentials even when Windows Digest is enabled.
Read 8 tweets
Stephan Berger Profile picture
Mar 11
1/ Number #6 of the #ActiveDirectory hardening measures:

Privileges and Permissions

🧵 #CyberSecurity
2/ #PingCastle lists, among many other things, the privileges assigned to domain users via GPOs.

The screenshot shows that the Default Notebook Policy grants Domain Users the SeLoadDriverPrivilege privilege.

Why is this bad?
3/ As @0xdf put it:

"If I can load a driver, I can load a vulnerable driver, and then exploit it." [1]

I know that some EDR's raise an alert when a vulnerable driver is loaded or dropped to disk, as such a driver could be exploited for a LPE.
Read 13 tweets
Stephan Berger Profile picture
Mar 10
1/ Number #5 of the #ActiveDirectory hardening measures:

Add Computers to the Domain

🧵 #CyberSecurity Image
2/ The following case is still worth mentioning:

A customer called us because he discovered two new computers within his computer objects that did not match his naming scheme. Image
3/ During the detailed investigation of the incident, it turned out that these SAMTHEADMIN objects were part of an exploit code that (if successful) would give administrative rights to a standard domain user.

A more in-depth write-up here:

Image
Read 6 tweets
Stephan Berger Profile picture
Mar 9
1/ Number #4 of the #ActiveDirectory hardening measures:

PowerShell Script Block Logging

🧵 #CyberSecurity
2/ Strictly speaking not part of a guide about hardening AD, but I must stress once again the importance of logging executed PowerShell code on clients and servers:



And here with several examples from our Incident Response cases:

3/ There are other opinions about PowerShell Script Block logging because, potentially, passwords or other sensitive data could end up in event logs, and authenticated users on the workstation or server could read these logs, thus giving away the sensitive data. [1]
Read 6 tweets
Stephan Berger Profile picture
Mar 8
1/ Number #3 of the #ActiveDirectory hardening measures:

Passwords

🧵 #CyberSecurity
2/ We talked about passwords in SYSVOL before:

3/ And here:

Read 7 tweets
Stephan Berger Profile picture
Mar 7
1/ Number #2 of the #ActiveDirectory hardening measures:

Service Accounts

🧵 #CyberSecurity
2/ In our AD assessments or IR cases, we repeatedly see that service accounts are highly privileged, often also part of the domain administrators group.

This can be disastrous, especially with a weak password for the service account:

3/ @Synacktiv took a closer look at the detection capabilities of Defender for Identity, including whether and how Kerberoasting could be detected. [1]
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

Send Email!

:(