performing-active-directory-vulnerability-assessment

执行 Active Directory 漏洞评估

概述

Active Directory（AD）是大多数企业环境中的主要身份和访问管理系统，因此是重要的攻击目标。本技能介绍如何使用 PingCastle 执行健康检查、使用 BloodHound 分析攻击路径，以及使用 Purple Knight 评估安全态势并进行评分，以全面评估 AD 安全性。这些工具可识别错误配置、权限过多、Kerberos 弱点和横向移动机会。

适用场景

• 开展涉及 Active Directory 漏洞评估的安全评估时
• 按照流程响应相关安全事件时
• 开展计划内的安全测试或审计活动时
• 通过动手测试验证安全控制时

前提条件

• 用于扫描的域加入工作站或域管理员访问权限
• PingCastle（https://github.com/netwrix/pingcastle）
• 带有 SharpHound 收集器的 BloodHound Community Edition
• Semperis 提供的 Purple Knight（免费社区工具）
• 用于分析脚本的 Python 3.9+
• 在 Windows 上运行 PingCastle 所需的 .NET Framework 4.7+

工具 1：PingCastle 健康检查

安装和执行

# Download PingCastle
Invoke-WebRequest -Uri "https://github.com/netwrix/pingcastle/releases/latest/download/PingCastle.zip" `
  -OutFile "PingCastle.zip"
Expand-Archive PingCastle.zip -DestinationPath C:\Tools\PingCastle

# Run health check against current domain
cd C:\Tools\PingCastle
.\PingCastle.exe --healthcheck

# Run health check against specific domain
.\PingCastle.exe --healthcheck --server dc01.corp.local --user CORP\scanner_account --password P@ssw0rd

# Run in scanner mode for multiple domains
.\PingCastle.exe --scanner --scannerlp

# Generate consolidated report
.\PingCastle.exe --healthcheck --level Full

PingCastle 评分类别

类别	描述	风险领域
过时对象	不活跃的帐户、旧密码、过时的 OS	幽灵帐户、过期凭据
特权帐户	管理员权限过多、嵌套组	域管理员权限泛滥、SID 历史记录
信任关系	林和域信任配置	滥用传递信任、SID 筛选
异常	安全设置偏差	GPO 错误配置、架构问题

PingCastle 关键检查项

# Critical items to review in PingCastle report:
- Accounts with "Password Never Expires" flag
- Accounts with Kerberos pre-authentication disabled (AS-REP roastable)
- Accounts with Kerberos delegation (unconstrained/constrained)
- Domain Controllers running unsupported OS versions
- AdminSDHolder permission modifications
- Accounts in privileged groups (Domain Admins, Enterprise Admins, Schema Admins)
- Trust relationships with SID filtering disabled
- GPO vulnerabilities allowing privilege escalation

工具 2：BloodHound 攻击路径分析

SharpHound 数据收集

# Download SharpHound collector
# https://github.com/SpecterOps/BloodHound/tree/main/packages/csharp/SharpHound

# Run SharpHound collection (all methods)
.\SharpHound.exe --collectionmethods All --domain corp.local --zipfilename bloodhound_data.zip

# Stealthy collection (minimal noise)
.\SharpHound.exe --collectionmethods Session,LoggedOn --domain corp.local --stealth

# Collection with specific domain controller
.\SharpHound.exe --collectionmethods All --domain corp.local --domaincontroller dc01.corp.local

# Run via PowerShell
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain corp.local -OutputDirectory C:\BH_Data

BloodHound CE 设置

# Deploy BloodHound Community Edition with Docker
curl -L https://ghst.ly/getbhce -o docker-compose.yml
docker compose up -d

# Access BloodHound CE at http://localhost:8080
# Default credentials shown in docker compose logs

# Upload SharpHound data through web UI or API
curl -X POST "http://localhost:8080/api/v2/file-upload/start" \
  -H "Authorization: Bearer $BH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"fileName": "bloodhound_data.zip"}'

BloodHound 关键查询

# Find shortest path to Domain Admin
MATCH p=shortestPath((u:User)-[*1..]->(g:Group {name:"DOMAIN [email protected]"}))
WHERE u.name <> "[email protected]"
RETURN p

# Find Kerberoastable accounts with admin privileges
MATCH (u:User {hasspn:true})-[:MemberOf*1..]->(g:Group)
WHERE g.name CONTAINS "ADMIN"
RETURN u.name, u.serviceprincipalnames

# Find computers where Domain Admins are logged in
MATCH (c:Computer)-[:HasSession]->(u:User)-[:MemberOf*1..]->(g:Group {name:"DOMAIN [email protected]"})
RETURN c.name, u.name

# Find AS-REP roastable accounts
MATCH (u:User {dontreqpreauth:true})
RETURN u.name, u.description

# Find unconstrained delegation hosts
MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name CONTAINS "DC"
RETURN c.name

# Find GPO abuse paths
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)
RETURN p

工具 3：Purple Knight 评估

# Download Purple Knight from https://www.purple-knight.com/
# Run as domain admin or with appropriate read permissions

.\PurpleKnight.exe

# Purple Knight checks 130+ security indicators across:
# - Account Security (password policies, privileged accounts)
# - AD Infrastructure (replication, DNS, LDAP signing)
# - Group Policy (GPO permissions, security settings)
# - Kerberos Security (delegation, encryption types, SPN)
# - AD Delegation (AdminSDHolder, OU permissions)

Purple Knight 评分类别

评分范围	评级	所需操作
90-100	优秀	保持当前安全态势
75-89	良好	处理高风险发现
60-74	一般	优先制定修复计划
40-59	较差	需要立即修复
0-39	严重	需要紧急响应

常见 AD 漏洞

1. Kerberoasting 暴露风险

# Find SPNs assigned to user accounts (Kerberoasting targets)
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName |
  Select-Object Name, ServicePrincipalName, PasswordLastSet, Enabled

2. AS-REP Roasting 暴露风险

# Find accounts with pre-auth disabled
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth |
  Select-Object Name, DoesNotRequirePreAuth, Enabled

3. LLMNR/NBT-NS 投毒风险

# Check if LLMNR is disabled via GPO
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name EnableMulticast -ErrorAction SilentlyContinue

4. 特权组成员资格过多

# Count members in critical groups
$groups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Account Operators", "Backup Operators")
foreach ($group in $groups) {
    $count = (Get-ADGroupMember -Identity $group -Recursive).Count
    Write-Output "$group : $count members"
}

修复优先级

发现项	风险	修复措施
可进行 Kerberoast 攻击的管理员帐户	严重	移除 SPN 或使用 MSA/gMSA
非 DC 上配置了无限制委派	严重	切换为受限委派/RBCD
管理员帐户的密码永不过期	高	启用密码轮换策略
可进行 AS-REP Roasting 攻击的帐户	高	启用 Kerberos 预身份验证
修改了 AdminSDHolder	高	审计并恢复默认 ACL
过时的计算机帐户（90 天以上）	中	禁用并移至隔离 OU
未强制实施 LDAP 签名	中	通过 GPO 在所有 DC 上启用

参考资料

• PingCastle GitHub
• BloodHound CE
• Purple Knight
• MITRE ATT&CK - Active Directory
• Microsoft AD Security Best Practices