cosmos, part 1: red-teaming corporate active directory forests

Sep 19, 2024

corporate networks face a constant and ever-evolving array of threats. at the heart of many enterprise IT infrastructures lies Active Directory [AD]. this is a directory service developed by Microsoft that provides authentication (AuthC) and authorization (AuthZ) services. AD is ubiquitous because of its robust capabilities in managing users, groups, computers, and access to resources across large-scale networks.

this also makes it a prime target for attackers. a successful attack on an org’s AD can lead to data breaches, intellectual property theft, or complete takeover of the corporate infrastructure.

red-teaming involves simulating real-world attacks on an org’s systems + networks. for AD environments, this means compromising user accounts, escalating privileges, moving laterally through the network, and ultimately gaining control over domain controllers. by emulating TTPs of actual threat actors, red-teaming helps orgs identify vulnerabilities, test detection + response, and strengthen their security posture.

corporate AD environments are typically set up in a hierarchical structure, often spanning multiple domains and forests to reflect the org-structure of the business. this complexity, while necessary for large enterprises, can introduce vulnerabilities if not properly managed. misconfigurations, overly permissive settings, or failures to follow principles of least privilege can create opportunities for attackers to exploit.

the real kicker is that because AD has an interconnected nature, a compromise in one part of the network can potentially lead to a full domain (or even forest) takeover.

scenario

the scenario here focuses on an on-prem AD environment. many organizations are now moving towards a fully cloud-based (or hybrid) environment, but on-prem AD remains prevalent in numerous enterprises due to regulatory requirements, legacy system dependencies, or specific business needs.

how would an attacker in this scenario gain their initial foothold? there are several ways in:

phishing attacks: tricking employees into revealing credentials or executing malware.

social engineering: manipulating employees to divulge sensitive information.

exploiting external services: leveraging vulnerabilities in web apps, VPNs, or other services exposed to the internet.

purchasing stolen credentials: gg ez.

in this CTF, everyone already starts with access to a user account, thereby circumventing the initial breach step. this means i can focus solely on the post-exploitation phase: escalate privileges and move laterally.

the attack chain demonstrates how a minor foothold can be leveraged to compromise an entire AD forest. hopefully, by sharing and understanding these attack paths, the security community can learn to better defend against them.

the forest

the target environment is set up as an AD forest named Cosmos.Local. a forest is the highest level of organization in AD and can contain one or more domains.

in this case, we have two domains:

Cosmos.Local: the parent domain.

Nebula.Cosmos.Local: the child domain.

these domains are connected by a two-way trust relationship, also known as a “parent-child trust”. what this means is that the users from one domain can be granted access to resources in the other domain, and vice versa. these trust relationships are common in large orgs where different departments or subsidiaries need their own AD domains but still require a level of integration.

the machines

`User.Nebula.Cosmos.Local`

role: end-user workstation (typical employee computer). initial point of entry which simulates a compromised user account.