AD – SAM Remote access enumeration

微信扫一扫,分享到朋友圈

AD – SAM Remote access enumeration

Introduction:

Querying the Windows Security Account Manager (SAM) remotely via the SAM-Remote (SAMR) protocol against their victim’s domain machines, allows the attackers to get all domain and local users with their group membership and map possible routes within the victim’s network. Recently, some frameworks (e.g. BloodHound
) have automated that mapping process
.

By default, the SAM can be accessed remotely (via SAMR) by any authenticated user, including network connected users, which effectively means that any domain user is able to access it. Windows 10 had introduced an option to control the remote access to the SAM, through a specific registry value. On Windows Anniversary update ( Windows 10 Version 1607
) the default permissions were changed to allow remote access only to administrators. An accompanying Group Policy setting was added, which gives a user-friendly interface to alter these default permissions.

SAMR: Remote Querying of SAM

The Security Account Manager Remote Protocol ( SAMR
) exposes the security accounts manager database for a remote authenticated domain user. It does so for both local
and domain
accounts. There are five objects that are exposed by the protocol; server, domain, group, alias and user. All these objects can be updated and read, and some (user, group and alias) can also be created and deleted.

Flow and Usage

The basic flow of using the SAMR protocol is as such:

  1. Connect to a server (the remote machine).
  2. Enumerate/lookup the server for domains.
  3. Open the domain of interest.
  4. Lookup a user or alias/group in the domain.
  5. Open the user/alias of interest.
  6. Query the user/alias of interest.

There are a few tools that utilize these API calls, such as Net User
/ Group
, PowerSploit
’s Get-NetLocalGroup
and Imapcket’s SAMRdump
. Net User and Net Group are Windows built-in command line tools. With these tools an authenticated user can add or modify and display information on users or groups respectively on the local machine or its domain controller. The Get-NetLocalGroup queries a remote machine for its local groups (including the “Administrators” and “Users” groups). SAMRdump, queries the target machine for its local users (using the EnumDomainUsers on the target machine). MicrosoftATA
detects the use of such query and alerts the security administrator about it.

Hardening SAM Remote access: https://gallery.technet.microsoft.com/SAMRi10-Hardening-Remote-48d94b5b

How ecommerce startups can win against Amazon

上一篇

5月发布!小米手环3外观、功能大曝光:配触控屏、支持NFC

下一篇

你也可能喜欢

AD – SAM Remote access enumeration

长按储存图像,分享给朋友