There's been a lot going on in security lately, from attacks on entire networks to sublime ransomware like Petya / WannaCry. Virtually every attack makes use of privilege elevation and privileged accounts, which allow access to other accounts' credentials (e.g., in the operating system's memory), free encryption of data or disabling security systems / creating backdoor paths / deleting logs.

 

Recently, as part of my work with Cyberark tools, I came across a free tool that allows you to perform an analysis for the use and vulnerability of privileged accounts (administrative, shared, service, application accounts, etc.). The program is very easy to use and does not require in-depth documentation analysis / training.

Launching is done by indicating the type of scan (windows / Linux, local, from the domain) and providing the appropriate credentials (importantly, the data remains on the scanning station, without access to the external network, the application does not require installation).

In the case of the "cautious" mode, the tool leaves no traces on the systems and on the station from which the scan is performed, the solution also has an extensive mode (selectable at the start of the scan) through which the theft of privileged account credentials is simulated. This gives additional value to security departments, as we not only detect privileged accounts, the scale of potential propagation in the organization's network through attacks such as pass-the-hash, but also show where access credentials are located and from where an intruder can steal them.

To run, either domain credentials giving permission to scan stations and servers are required, or credentials entered individually for each system (e.g. via a defined csv file).

 

From the data, a report is produced that provides answers to such questions as:

• how many privileged accounts are in the local and domain environment
• what is the scale of use of service accounts, both local and domain
• what vulnerabilities related to privileged accounts the organization has, e.g., the privileged account password has not been changed in 14 years (example of one of the scans), weaknesses related to SSH keys, e.g., lack of rotation, weak algorithms, lost keys, etc.
• what is the scale of use of the pass-the-hash attack, so that we can see the potential for propagation in the environment in the event of the seizure of a particular account on a particular system (station or server)
• The possibility of executing a Golden Ticket attack in a domain environment - what accounts and stations/server compromise the organization
• Where privileged accounts are sewn into the applications and what, if any, consequences they may have
• Where privileged accounts are abused (e.g., local administrative accounts for business purposes)

I have performed many such scans with my clients. What I found interesting is that in many cases, despite the use of conventional security systems, the potential takeover of an employee's "subordinate station" can cause an unnoticeable jump in the environment not only to the server level, but also to the domain controllers, with the result that the intruder can get into any software of the institution using kerberos or NTLM protocols. The scan by showing dependencies also shows which accounts are struggling: "I can't change the password / key" because I know that a given account is used by services but I don't quite know which ones. The solution allows a neutral look at the current state of the environment from the side of privileged accounts, make adjustments and reduce the risk of attack. 

For those who are interested, I provide our form so that I can generate a key to run the program and send the tool.