Episode 173: How to Find Insecure Active Directory Permissions with ADeleg

0:00So a delegate is an active directory delegation management tool and what I really like about it is it gets you almost the same amount of information that bloodhound gets you, but with like a third of the hassle, right? You don't have to set up bloodhound and you don't have to run the sharp pound collector in your environment and trigger all your EDR alerts. You don't have to set up docker to like set up the bloodhound UI and node for NeoJ and all that. So it's a super, super handy tool for finding misconfigured permissions and active directory. So that's what we're going to talk about. We're going to dive into this tool and specifically we're going to show you I'm going to share my screen. We're going to talk Tyler and I are going to talk through kind of what we like about it and kind of how we go about finding misconfigured permissions and active directory. So if you're listening to this, hop over to either YouTube or Spotify, then we're uploading

1:01videos there now as well to look at kind of the demo of this. But that's what we're going to be talking about. So Tyler, quick 411 or high level, what's a delegate from a high level? Why do we use it kind of where do we use it? What's the skinny of this? Yeah. Very, very high level. It is just a tool that enumerates delegated permissions for different users and groups. I think it's a great entry point on an internal Pintas because it will show you your very high permissions users. Then you can tell that just by the delegations that they have, you can also find misconfigurations for some users and maybe able to do dangerous things in the environment, even if they're not admin based users. So it's just a very exploratory tool that's super easy to get up running early in an engagement. Yeah, one of the reasons I like this tool is because it's very quick and easy to get up and running. And I'm going to share my screen in a minute. But you literally download this program, this binary, you put it on a machine that's

2:04domain joined, you double click it, you run, you click connect, and you're there, right? And the time to value for this tool is super high and it helps you with two things and two things that I talk about often when it comes to active directory permissions is you have to know where to look and you have to know what to look for, right? And that's where some of this expertise comes in. So let me share my screen. Okay. So up on my screen now, I have a delegate and I've already opened it, but essentially you just download it and we'll include a link to the GitHub repo in the show notes. But you go to the GitHub repo, you download the tool, you double click it, you click connect, and then you're here. Now the first thing I like to do is I'm kind of a left to right reader. So the first thing I do is I go to view index view, buy, and then trustees. And essentially this just reorganizes the view in a certain way and it puts the trustees on the left and the resources on the right.

3:04And then we can start kind of poking around and looking at stuff. One of the common misconfigurations that we often see is when low privilege users or what I call unsafe users or unsafe groups has unsafe permissions. So Tyler, why don't you maybe walk us through what unsafe users are and what unsafe permissions might be. Yeah. So your unsafe users, I guess unsafe groups as well. I feel like it's more what we target here unsafe groups have permissions. I think a golden example is one that you had on a pentast a few weeks ago where domain users had was it forced change password over all other users in the domain. So as a low privilege user, you had an ace that allowed you to reset the password of every other user. Sometimes there would be groups that you'll have delete permissions over as a low level user. That's also dangerous just being able to do things from orbit.

4:06So this also helps with certificate templates. The problem is it's not always a thousand percent accurate on certificate templates, but there's other tools for that. But it's just a nice quick snapshot to what rights your low level user groups have. So authenticated users, domain users, everyone groups are probably the most prime targets. I think outside of that, you know, exploring admin groups, seeing what all permissions are listed there, or even computer objects as well, this enumerates. Yep. So unsafe users or unsafe groups is what we define as just a group of users that should not have elevated rights. So Tyler, just hit on them, everyone, like the everyone group in active directory authenticated users, domain users, domain computers, those are like the top four groups that we look for first when we use this tool. So on the screen, you could see that authenticated users is selected here on the left.

5:06And on the right, there are resources here in the middle. Then we have the type, which is just allow owner, deny, etc. And on the far right in the details column, it shows the permissions or the delegate rights that have been assigned to this resource, sorry, to this trustee on this resource. So as we look down through here, some of the more interesting ones are like, you know, this is a contrived example. This is my lab. So it's going to say things like generic all and all that. So it's going to call it out. But imagine this is like XYZ certificate template. What this is saying and how you read it is authenticated users have right all properties and this other stuff on this object in active directory. This ESC4 generic all certificate template. We can tell that based on the distinguished name here of the object. Another example is, let's see here, this ESC4 right owner template.

6:10So we as the authenticated users have the ability to change the owner of that certificate template. So unsafe users, like I said, unsafe users and groups are authenticated users, everyone, domain computers, domain users. You could also be like the accounting group or finance or HR or any other kind of low privilege group in your environment. And then unsafe permissions are things like change owner, write all properties, full control, generic all, delete, create child objects, reset password, force change password, kind of all the things that give users a little bit more elevated rights in the environment, rights that would be typical of an admin account. And one use case for using delegated rights is let's say you have a help desk group and you don't want help desk to maybe have administrative rights all over the domain. So you don't put them in domain admins, but you still want them to have permission to

7:14say reset passwords. So by using delegations and active directory, you can give them the permissions to reset passwords, but not be able to modify the domain entirely. So that's one use case here that where you would use delegated rights. So this is a perfect example of the types of users and permissions that you would see. So I'm going to jump over, I'm going to show another example here. I'm going to go to my Urika domain users and I'm going to show domain join. So this one is interesting because this is a straight from a pen test that, you know, this is something I commonly see. By default, when you join a computer to the domain, it has ownership rights over that active directory object. Now, we don't see any ownership rights here because I haven't set that up yet in my lab, but essentially I wanted to call this out because this AD join account is one that I commonly see over permissioned.

8:16And this domain join account we can see has perform all application specific operations, write attributes. We can write the DNS name, same account name, essentially have full, almost full control of these objects. And this is one of the common examples that I see on internal pen tests. So this is one example that I would look for outside of the typical low-perlidge users that I look for to see if there's any misconfigured permissions here. Yeah. And I think a dialogue isn't as flashy a tool as some of the ones like pingcastle, for example, you don't have this report where the findings are laid out for you. You kind of have to hunt for them. And I find that a dialogue is more of my favorite entry tool to use on an internal. I'll run it before I do pingcastle because while pingcastle will enumerate some of the same things, you'll see some delegations. The overall layout format of Adeleg makes it super, super easy and convenient.

9:16Just to see just to see resources and then permissions over those resources in a very snapshot view. So you can probably go through Adeleg. How long does it probably take you? Maybe 20 minutes for like a short little review. And then it's extremely helpful as well if you happen to compromise an account or anything of that nature during an engagement, you can go back in Adeleg and say, okay, I have this new account, what permissions, what delegated permissions does the account that I compromised have. Exactly. So it's a tool that you can go back to during an engagement and get benefit from. Yep. Exactly. So let's say we compromise this Ace Fuentes account, right? Well, this account we can see has reset password on all child objects. It has right attribute password last set. If you compromise an account, you can come into Adeleg and you can look and see what those permissions might be if there's any delegated rights or delegated permissions assigned.

10:18So this is to your point about being easy. This is very familiar for all of the AD admins out there. This is, you know, the tree on the left is set up very similar to Adeleg, actor, director, users and computers. It's very, you know, it's a very similar kind of environment to kind of click through. Here's another example where this Thomas Singleton account has right all properties on this group policy. This is a group policy here and we know it because it's in the policies container. So this is saying that this account has the ability to modify everything within this group policy. So just a great example. So that's one way to look at it is you can look at it with using the trustees on the left. You can also go the opposite direction. So if we change the view by we go to resource. Now we can look at the resource specifically. So let's say we want to look at the domain controllers OU, we'd say, oh, let's look and

11:19see if there's any misconfigured permissions there. We see this test account has right all properties on the domain controllers OU. So rather than hunt for an account that we might not know, right, it might just be this obscure account that's buried in there. We can look at our privilege resources and kind of do an audit that way to see if there's any missing misconfigured permissions there or any accounts or groups that we don't recognize. So this is a perfect example here. I wish I had more delegations in here to show because normally when we see this, right, it's like buried in a bunch of delegations and then we're kind of finding the needle in the stack of needles. This is my lab. So there's not a lot in here. But just to show an example, we can see these different OU's and groups. We can see misconfigured permissions here. Yeah. And another thing, the larger the environment, the longer Adelaide is going to take to fully enumerate information and show it in this nice view, there have been some engagements.

12:20I think you had one massive client where Adelaide, how long did it take to actually pull up? Ours. So that's a good point is I haven't done any benchmarks on the size and how long it takes. In a fairly small domain, maybe like a thousand or a couple thousand users, maybe all the way up to like 5,000 users, something like that, it opens pretty quick. So maybe 30 seconds to a minute max. But as you get larger, if you have 100,000 users, if you've got a million accounts, like we did a university, and it was a very large university, and they had a lot of accounts, and not all of them were active, because student populations recycle and stuff like that or they graduate and accounts are still left in there. But if you've got a large active directory for print, yes.

13:20This could take a few minutes to several minutes to several hours to load. I think when we did, when I did that pen test, I just opened it and then I was like, sitting there waiting like 10 minutes and I'm like, sipping my coffee and I'm like, and then I'm like, wait a minute, this is probably going to take a while. And I think I came back to it like in the afternoon and it was open. So it multiple hours to open it in that case. I think the longest it's ever taken me is probably around a half hour open. It's probably the biggest environment that I've used it against. Yeah. So not I want to touch on that because there are, there's a, there's a common misconception that you have to use, say, bloodhound or that you have to use specific tools to find specific issues. And it's just not true. You can find a lot of these issues with pink castle, with purple night, with bloodhound, with a delegate.

14:21There's another great power shell tool that I'm forgetting that can pull permissions in active directory. There's AD recon. There's a lot, there's power view. There's a lot of tools that you can use. And this is one tool that I think is, is very efficient and quick and easy to use. So it's one we like to talk about because from my perspective, right, I'm a former sysadmin. I don't think a lot of sysadmins are going to go and download bloodhound, docker, get it stood up, you know, deal with the sharp pound collector, know how to use it, pull in the information and all that. When they can run something like pink castle and purple night and a delegate and get, I don't know, 80% of the way they are, 80% of the information that they would find in those other tool by using this. So it's all about quick wins for me. It's like, how can I get immediate quick wins, where can I get the highest time to value

15:22essentially with the tools that I'm using? So that's why we really like it. Yeah, and I think for any red teamers, this tool is a lot better than some of the alternatives for what it does because it's not very noisy. I haven't seen EDR alerts generate for a delegate. I haven't seen any signature based detections for it either. So in terms of being early in an engagement and still wanting to be low and under the radar, I think a delegate is a great tool that can enumerate active directory information that you want and the delegated permissions without generating any alarms or, you know, calling attention to yourself. Yeah. And you mentioned it earlier. I want to touch on it is certificate templates, right? If you've ever looked at the permissions of a certificate template, just think about the workflow for this and how much faster this is, right? If you want to get permissions for a certificate template, you either need to log into the CA, you know, go to manage templates, you right click on it, you go to properties, the

16:24security tab, and then you look at it, and then you got to look at the next one. Or you could write a PowerShell script, right? But if you're not comfortable with PowerShell, if you don't have that PowerShell food capability, it could take a while, especially if you have like here, like I have, I don't know, a dozen or a couple dozen templates or something like that here, imagine how long it would take to just go through each one of these and look at the permissions, right? With a delegate, you just click on it, you just click on it and you look, click on it in a look, and there are some false positives. So let me see if I can find one. I think he's a built-in templates. Yeah, I was going to say, I think the user template will be a good one. Actually, I might have misconfigured this one, I don't know. Anyways, there are, so for the built-in templates in ADCS, such as the user template, the EFS template,

17:24are they going to change the template was another? Yeah, there's a there's a handful of built-in templates that will come up as a false positive. It'll say like, like it shows here, domain users has write-all properties. This one I might have intentionally misconfigured, so I'm not 100% sure. But some of these will come up and they will say that they have additional permissions. It's usually the built-in templates. And in those cases, we just validate with another tool like locksmith, right? Another free tool to enumerate ADCS template permissions. And it's quick and easy to run, right? So if you see something here, you can quickly kind of double-check it with another tool like locksmith. I remember some of my first internal penta, some of my first experience, like going in there and seeing write-all properties over the certificate template and getting really excited only to be completely bummed out a few minutes later when I went and double-checked it in pink castle at the certificate template delegations.

18:25So it is a catch on those. I think that's the only false positive that I see within this tool though. Everything else, all the other information is pristine and true. It's just the built-in certificate templates that can kind of trip you up. Yeah, I agree. I don't think I've seen a ton of false positive outside of this. And we use this on every single internal engagement. We compare it with numerous different sources of information as well during the pen test. So the information here is very, very consistent. I will say there's some bugs in kind of some quality of life that could be improved with this. Some, much of which is on my radar. And it's a project that I plan to push some improvements to and updates to. It's not my own. I didn't write it. It was written by a man, a person called Matthew Buffett. I think it is named. And again, I'll put a link in the description for the repo.

19:28But this has now been rewritten in C-sharp. So for anybody listening, if anybody has any desire to kind of improve this or share ideas of how to make it better, any features, things like that. There's a lot of quality of life things that I would like to contribute to this project at some point and when we get more time in the day, right? But this is such a great tool for finding misconfigured permissions in Active Directory. And pretty much every time I go to a conference or I talk to people who are IT admins, I always ask them, like, have you heard of this tool? 99% of the time they haven't. And it's funny because I was just at Zero Trust World a couple of weeks ago. I was doing an AD hacking lab and I showed them this tool. But before I showed them, like, raise a hand or buy a show of hands, how many people have heard of Adelaide in like seven people raised their hand out of like a huge room of 200 plus people.

20:29So very low statistically likelihood that if you're new to this podcast that you've heard of this tool, so definitely go check it out. Yeah, I've noticed with us, when we're in a recon phases, early phases of an internal open test, you know, once kind of the end point configuration reviews done, we've got that piece settled. Recon, it's all about quick wins. Quick tools that we can run to get 80% of the information, 20% of the time. You know, and this is another one of those tools that just absolutely smashes that. Because if you're not in a ginormous environment, if that's not the norm that you test against or it's not the norm that you work in, this this tool pops up 30 seconds. You've got all the information you need. And for us as attackers, the more information we can get our hands on in a shorter amount of time, the better we're off and the more time that we can spend, you know, leveraging this configured permission. So Adelaide is definitely a stellar tool. Yeah. What else is there anything else we should show with Adelaide that you think we missed or didn't touch on?

21:35I think that was all the all the high points. All right, cool. I'll bring it back now. So yeah, Adelaide is super, super great. Like I said, we'll put a link in the description for the GitHub repo where you can find this tool. Obviously, you want to test it in your environment and make sure it's safe by your standards. We never recommend like you just blindly go download a tool and run it. In this case, you know, we've, you know, we're fairly confident that this is not malware. We looked at it. The source code is up on GitHub. You can look at it. It doesn't seem to cause any resource issues or anything like that. So it's pretty safe to run in your environment. And yeah, it's super great. So if you are an AD admin, an IT admin, if you're a security professional, definitely check out Adelaide and use it in your environment. Because I think it'll provide you a ton of value for finding misconfigurations with permissions in AD. So yeah, that's it. This is going to be a short one. We just wanted to

22:40show Adelaide and talk about it. We talk about this all the time, any chance we get. So if you like this type of tool time kind of demonstration podcast, let us know. And you can check out all our content on offsec.blog. If you're not subscribed, make sure you subscribe on YouTube and Spotify and all that jazz. And if you like this, leave us a rating. And there'll be more to come like this in the future. So that's our episode every new episodes every Friday. So subscribe. And we'll see in the next one.