Computers Gone Rogue: Abusing Computer Accounts to Gain Control in an Active Directory Environment

No ratings

Presented at bluehat 2018 by

Itai Grady

Marina Simakov

Active Directory has always been a lucrative target for attackers since it serves as the main storage of all credentials in a domain environment. Attackers usually target user accounts to gain an initial access to domain resources and use them to move laterally in the network, until eventually compromising a domain administrator. Hence, many monitoring systems track the behavior of domain accounts to find potential anomalies in case the account is compromised.In most cases, the focus is on user accounts, who are usually the ones targeted to get high privileged access in the environment. However, a lot of attacks may incorporate the use of computer accounts to compromise the domain and even gain persistence once the required privileges are acquired. In this talk we will discuss how computer accounts can be abused, starting from the initial attack stages, continuing to the lateral movement phase, and finishing with how a computer account can be used to gain a TGT for any administrative account in the environment while hiding the computer account to avoid detection.