{"id":24655,"date":"2022-05-26T01:41:12","date_gmt":"2022-05-25T23:41:12","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=24655"},"modified":"2022-05-26T01:41:12","modified_gmt":"2022-05-25T23:41:12","slug":"microsoft-gibt-hinweise-zum-schutz-vor-krbrelayup-angriffen-in-windows-domains","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2022\/05\/26\/microsoft-gibt-hinweise-zum-schutz-vor-krbrelayup-angriffen-in-windows-domains\/","title":{"rendered":"Microsoft provides guidance on protecting against KrbRelayUp attacks in Windows domains"},"content":{"rendered":"

\"Windows\"[German<\/a>]KrbRelayUp attacks allow local privilege escalation in Windows domain environments where LDAP signing is not enforced. The default Active Directory settings are still insecure. However, Microsoft has now explained in a post how administrators can protect systems against KrbRelayUp attacks in Windows domains.<\/p>\n

<\/p>\n

\"\"I had briefly reported on KrbRelayUp attacks in Windows domains in the German blog post Sicherheits- und Datenschutzmeldungen (28. April 2022)<\/a>. A KrbRelayUp attack allows local privilege escalation in Windows domain environments where LDAP signing is not enforced. On Github<\/a>, someone had published a wrapper in source code that should simplify these attacks. So administrators should act and enforce LDAP signing. <\/p>\n

Microsoft publishes security guide lines<\/h2>\n

Microsoft has now published a blog post Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp)<\/a> on the topic, showing how systems can protect themselves against KrbRelayUp attacks on domain controllers. I came across the topic via the following tweet<\/a>.<\/p>\n

<\/a><\/p>\n

The background is probably that on April 24, 2022, a hacking tool, KrbRelayUp<\/a>, <\/p>\n

was published on GitHub for privilege escalation by security researcher Mor Davidovich. KrbRelayUp is a wrapper that can streamline the use of some features of the Rubeus, KrbRelay, SCMUACBypass, PowerMad\/SharpMad, Whisker and ADCSPwn tools in attacks.<\/p>\n

Microsoft recommends that its customers update Domain Controllers so that LDAP server signing requests are set to \"signing required.\" This was described in this advisory<\/a>. This blog describes<\/a> ,how to enable Extended Protection for Authentication (EPA). The Microsoft blog post describes the attack path and provides guidance on how to mitigate these attacks. <\/p>\n","protected":false},"excerpt":{"rendered":"

[German]KrbRelayUp attacks allow local privilege escalation in Windows domain environments where LDAP signing is not enforced. The default Active Directory settings are still insecure. However, Microsoft has now explained in a post how administrators can protect systems against KrbRelayUp attacks … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,2],"tags":[69,159],"class_list":["post-24655","post","type-post","status-publish","format-standard","hentry","category-security","category-windows","tag-security","tag-windows-server"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/24655","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=24655"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/24655\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=24655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=24655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=24655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}