TR18: Attack and defend Microsoft Enhanced Security Administrative Environment

### Overview In this presentation, penetration testers Hao and Pipe discuss techniques for attacking and hardening Microsoft's Enhanced Security Administrative Environment (ESAE), commonly known as a Red Forest. While the ESAE tiered administrative model (Tier 0, Tier 1, and Tier 2) is designed to isolate administrative credentials and prevent lateral movement from standard workstations or servers into domain controllers, real-world misconfigurations and secondary management channels often allow attackers to bypass these boundaries and escalate privileges to Tier 0.

### Key Topics The speakers outline several major vectors used to bridge tiers: - Abusing Active Directory permissions and discovering overlooked "shadow admin" accounts. - Subverting virtualization infrastructure (such as VMware vSphere) hosting virtualized domain controllers. - Abusing centralized endpoint security and management platforms (antivirus, configuration management, backup, and EDR tools). - Identifying weaknesses and misconfigurations in Multi-Factor Authentication (MFA) provisioning and self-service portals.

### Technical Details - **Active Directory Permission Abuse & Shadow Admins**: Attackers search for accounts with non-standard administrative privileges such as `Replicating Directory Changes` and `Replicating Directory Changes All` (enabling DCSync attacks). Service accounts in applications like Microsoft SharePoint (User Profile Service account), Riverbed SteelHead, and on-premises directory synchronization servers frequently hold these permissions. Additionally, Microsoft Exchange servers (via `Exchange Windows Permissions` and `Exchange Trusted Subsystem`) possess domain-wide write rights; running as `NT AUTHORITY\SYSTEM` on an Exchange server allows granting DCSync rights to standard users using tools like PowerView. Attackers can also target write permissions on the `AdminSDHolder` container, which propagates permissions to protected groups. - **Virtualization Infrastructure Attacks**: Virtual domain controllers expose Tier 0 to hypervisor administrators. Attackers leveraging compromised vCenter credentials or console access can bypass network segmentation. By using data store browsers, PowerCLI scripts, or tools like Veeam Backup to take snapshots, attackers can extract raw VMDK files. Once downloaded, multi-part VMDKs can be merged, loopback-mounted on Linux, or parsed with forensic tools to extract `NTDS.dit` hashes without ever directly touching the running OS (provided full-disk encryption is not implemented). - **Endpoint Management Exploitation**: Centralized agents running as `NT AUTHORITY\SYSTEM` cross tier boundaries. In Symantec Endpoint Protection, an attacker with console access can configure Host Integrity policies using VBScript payloads to create a user and add them to Domain Admins on managed domain controllers. Similarly, Microsoft SCCM (via GUI or PowerSCCM), Veritas NetBackup (restoring `ntds.dit` from unencrypted backups), and cloud-hosted EDR platforms (like Carbon Black, targeted via phishing and live-response shells) can be weaponized for code execution and credential harvesting. - **MFA Provisioning Weaknesses**: Attackers exploit self-service portals that rely solely on single-factor domain credentials or default ports (e.g., port 7004). Flaws include unexpired enrollment links left in mailboxes, unmonitored enrollment that lacks notifications, missing rate limits on registered devices, look-up table PDF cards stored in inboxes, and reusable QR activation codes.

### Takeaways To properly defend ESAE and Active Directory environments: - Audit permissions for shadow admin rights, not just explicit group memberships, treating accounts with DCSync or object modification rights as Tier 0. - Strictly isolate virtualization infrastructure hosting domain controllers, or keep Tier 0 on dedicated hardware, and mandate full disk encryption for virtual DCs. - Implement separate, segmented endpoint security and management infrastructure per tier so management agents cannot bridge Tier 1/2 to Tier 0. - Secure MFA provisioning by expiring enrollment links, requiring multi-factor authentication to access self-service consoles, and enforcing device enrollment limits and notifications. - Restrict and rotate credentials using Managed Service Accounts (gMSAs) and dedicated privileged access workstations.