It's time to start wrapping things up.
In the next five to six skills, we're going to be diving in
and using most, if not all, of the skills that we've
learned together in the big domain environment.
It's time to start attacking Active Directory.
Now, will we get into every nook and cranny of everything
that we can do inside of Active Directory? Absolutely not.
But there are a couple things that I want to point out,
as this can be considered a mini intro for the last part
of this course. And that is that Active Directory
is primarily the target for us pen testers out there,
because believe it or not, even though there are a lot of
POSIX-based servers and POSIX-based environments
out there for organizations, Active Directory
is probably one of the most used domain features
and capabilities out there.
Now, I'm not going to try to go into statistical studies
over this, because as you may or may not know in previous
courses, stats ain't math. But as we take a look at
Active Directory, we're going to be looking at it from outside,
looking in, and moving into a different lab.
I know, I know. Now, this is going to take a little bit
of time on the back end, and also a little bit of time
on your part as well, too, because while this may not be
difficult, and it shouldn't be because of everything
that we've been working with together so far,
this will take a little bit of getting used to and moving
into that domain infrastructure environment.
Now, there's a couple things I want to review real quick.
Now, we've got some fancy artwork here that shows us
the basic concept of how a domain controller works.
We have all of our users spread out using different
resources, different user accounts, different passwords,
and being in different segments of the network,
all using that domain controller to use for authentication.
And we'll get more into the authentication type and how
it works here momentarily. I just wanted to give you the
idea that what we're taking a look at here is the
traditional, quote, unquote, sense of Active Directory
domain structure, because prior to Azure, what we were
taking a look at is basically just one forest,
a couple of subdomains, and basically just having that
one master domain controller for us to be able to
go into for authentication. And through that
authentication, we were able to set security policies
and permissions on files, folders, and even
capabilities on the local systems through group
policy implemented on top of local security policy.
Now, for those that remember back like me in the
NT days, this domain controller that you hear is the
primary. And there is nothing really that different
from then to now except for the fact that there's no
secondary or backup. It's all considered, quote,
primary. So the only thing that we may get into as
far as actual enumeration of the Active Directory
portion is concerned is the fact that inside of
Microsoft, there are domain controllers that have
normal capabilities for authentication. You create
users, you create groups, you can create accounts that
are service accounts, policies, and all that great
stuff. But there are things out there called RODC,
or read-only domain controllers. Now, for pen
testers, this means that those RODCs can't have the
ability to create accounts on them. What it does
mean, though, is that we can do enumeration on them
and it looks normal in terms of actual network
traffic. So this is something to definitely keep in
mind as we start going throughout because in our lab
environment, we do not have an RODC. And this may be
something I change later on as we continue. But we're
going to treat the enumeration process throughout the
next few skills as if we were on either one because
we don't need write capabilities on a domain
controller for us to be able to populate what users
or groups or security policies are out there. And
what we have on the screen is a network map of Azure.
Now, this is the Azure that we were just referring
to earlier as far as Active Directory having many
new names now. And it's at this point I want to
point out to you that Knox has a full-on Azure
Active Directory class that's certificate-based in
Microsoft. And I would highly, highly recommend you
go check out his course here on CBT Nuggets. The
reason for this is because looking at this map, we
see a few things. On the right, we have our Azure
based cloud. On the left, we have our subdomains or
within the forest. Now, I'm not going to go too far
into actually how to engineer a network map and take
a look at what's actually going on here because
there's no information for us to obtain as pen
testers. There's no FQDNs. There's no IP addresses.
There's no MAC addresses or anything like that. But
what this does do is lead us into the fact that
Active Directory as a structure is moving into that
cloud infrastructure environment. And as pen
testers, that's pretty important to note. Throughout
the course of us pen testing in the wild out there,
we may run across organizations that are not
physically based for their IT infrastructure. And
that network diagram that you just saw moments
ago may, in fact, be applicable to the pen test
that you conduct on site. And this is going to
really play into the scope and rules of engagement
of what we're allowed to do in terms of actually
going out and touching those Active Directory
servers. Now, I don't want to get too far in the
weeds on that because our lab is all locally based.
But the idea behind this is that you may have
domain controllers that are geo dislocated from
each other. And that's where knowing how Active
Directory and the Microsoft environment works comes
really handy because now you have an idea of what
to look for in terms of network traffic. And we
will be examining some of that in this very skill
to get an idea of what that looks like. Known
ports and all that other great stuff. Because if
these domain controllers are, in fact, spread out,
geo dislocated and have a cloud infrastructure
going on, not only do we know that we're going to
be spread thin as far as like IP addresses and
different targets to acquire is concerned, but then
we get into the idea that replication times may
vary. In a cloud environment that has ample
bandwidth and ample connections to the Internet,
replication for Active Directory can be anywhere
between five minutes and an hour or even longer
depending on things like latency. I'm not quoting
exactly. I'm just telling you from experience on
this one, because if you make a change on an
Active Directory domain controller at site one and
site one is in Portland, Oregon, or matter of
fact, Eugene, Oregon, and then site two is in,
let's say, Austin, Texas. And you want to make
sure that that change is applying to Austin. It
could be that you have to wait for the latency
or for the replication cycle within Active Directory
to catch up. And that's geo dislocated as well.
It could be that those are creating a cloud
environment. And that cloud environment contains a
lot of different possibilities. It could be that
we have a public cloud, which is things that
we've talked about with public facing interfaces
like web servers that allow us to be able to go
in and touch them and do vulnerability assessments
and even potentially take them over to be able
to scan into the private cloud. Because going
into a pentest that is cloud based takes
everything that we have learned and just applies
it a little bit differently. There's no
difference between a singular network, singular
domain controller environment having a private
network, a DMZ, and then a web facing server
out there that has a public IP address, then
a public cloud, a private cloud, and things
behind it. The only difference is, is that
these different portions of the network and
their devices are going to not be in the same
room with each other. So as far as like
thinking this is more complicated, it is
absolutely not. We just have to be able to
map out the network and run our assessments
and things like Nmap, vulnerability scanners,
Nessus, etc. and make sure that we have a
proper accounting of all devices within the scope
of our pentest. Because based on the scope
and ROE and etc., you've heard me bang on
about this for a while, it could be that in
the image that you see here, that the highly
virtualized data center is a part of our pentest
but resides within the private cloud. So it's
something that we have to work our way to in
terms of being able to pivot within the network
itself. Pivoting is going to be critical in a
cloud environment because you can't just walk
over to the system with ease and just pick it
up and go. It's something that you're actually
going to have to be able to properly map out
the network. And as you look at the bottom of
this graphic, you see that you have identity
and that's what we're really honing in on
here. Because under management, development,
virtualization, all that great stuff, the
authentication comes straight back to Active
Directory, which is the focus of this skill in
the next view.