Introduction and scenario of create active directory lab
posted on 01 Aug 2022 under category Active-Directory in series Active_Directory
Active Directory is a directory service provided by Microsoft that is commonly implemented within organizations for structuring and networking purposes. Active Directory, often abbreviated as AD, uses a secure hierarchical containment structure called logical structure, allowing administrators to organize objects into a hierarchical collection of containers. Additionally, Microsoft’s Active Directory offers a number of authentication and authorization solutions that allow organizations to organize their network and resources. To put it simply, Active Directory allows administrators to create and manage resources, users, domains and other objects within a network. For instance, a network administrator may create a group of users and provide them with permissions to a specific resource within a network.
Microsoft’s Active Directory remains a primary directory service solution within organisations’ networks. It is vital for companies to understand and identify potential security weaknesses of Active Directory, as it remains a major pivot point utilized by cybercriminals to compromise organisations worldwide, including governments and companies. In order to detect security threats and remediate vulnerabilities, understanding the prevalent Active Directory attack techniques and threats they pose to organisations is critical. In this section of the introduction, a brief background into the attacks against Active Directory environments is provided. Typically, a high-skilled and well-organized Active Directory attack consists of multiple phases as it can be seen in the figure below:
As demonstrated in the figure above, phishing is a key phase in an Active Directory attack that may lead to a victim providing sensitive information to the attacker or installing malicious software. That way, a perpetrator can gain a foothold inside of an organisation’s internal network and carry out further attacks.
Following that, an attacker performs enumeration to increase the attack surface by discovering valuable information about the deployed environment, and potentially retrieve sensitive user data. As credential theft is carried out, it may be used to carry out exploitation attacks against the authentication and authorization systems inside the network. Additionally, a perpetrator may discover implemented vulnerable software and perform exploitation attacks against it to gain further access within the network. As an attacker gains access to any accessible entity, such as a low-privileged user, they can perform privilege escalation techniques in order to move laterally and vertically across the Active Directory network to gain access to valuable assets, such as confidential data, high-privileged accounts and more. As a final stage of the attack, a malicious insider may perform various techniques in order to obtain persistence within the network.
In summary, Active Directory is a widely adopted and useful technology solution for managing complex resources and corporate networks. As explained earlier, Active Directory holds a large and complex attack surface and, therefore, is a major pivot point for cybercriminals to compromise companies. Additionally, as the Active Directory is a critical application, dealing with various sensitive data, within the majority of enterprises, it is vital to increase its security and understand the potential security threats it raises. Providing staff with learning material and training environments is a great approach to learn more about the security of various technologies, including the Active Directory. One of the ways to gain experience
and learn Active Directory security is to understand the attacking techniques by performing them in a virtual environment. In addition, lab environments are a great way to learn about the modern techniques and tools used by cybercriminals.
The lab consists of five lab machines, including the pfSense (Router) , Domain Controller and three client machines. And Scenario :