ADDOM-013: Requisitos de firma LDAP
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Critical
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La firma LDAP debe ser obligatoria en todos los controladores de dominio para evitar ataques de adversario en el medio sobre el tráfico LDAP. Sin firma, los atacantes pueden interceptar y modificar consultas y respuestas LDAP, lo que potencialmente permite escalar privilegios o exfiltrar datos
Por qué importa
Unsigned LDAP is the single most reliable cross-protocol relay sink in a modern Active Directory environment. An attacker who can coerce authentication from any computer account (PetitPotam, PrinterBug via MS-RPRN, DFSCoerce, or the recently disclosed Authentication Coercion variants) can forward that NTLM authentication to a domain controller over LDAP or LDAPS and, because the bind is unsigned, the DC accepts the relayed session and acts on the attackers behalf. With write access via the relayed session the attacker can grant DCSync rights (T1003.006), add a computer to a privileged group, write a shadow credential to msDS-KeyCredentialLink for an account they control, or in combination with an Enterprise CA write an enrollment for a domain controller certificate that yields persistent Tier 0 access. The blast radius is the entire domain: a single coerced print spooler on any unprivileged host plus an unsigned LDAP listener on any DC is sufficient to take over the directory. Microsoft acknowledged this in advisory ADV190023 and shipped channel binding and signing controls in the March 2020 LDAP signing servicing baseline.
Ruta de ataque
The standard kill chain is well documented. Step 1: the attacker establishes a listener on the local network using impacket-ntlmrelayx with the target set to ldap://dc01.contoso.local or ldaps://dc01.contoso.local, with an action such as --escalate-user attacker, --add-computer, --shadow-credentials, or --delegate-access. Step 2: the attacker coerces authentication from any machine account in the domain, typically with PetitPotam (CVE-2021-36942), PrinterBug, or DFSCoerce, by calling the EfsRpcOpenFileRaw, RpcRemoteFindFirstPrinterChangeNotificationEx, or NetrDfsRemoveStdRoot RPC against a target host with credentials referencing the attacker UNC path. Step 3: the target machine account NTLM authenticates to the attacker, who relays the unsigned NTLM session to the DC over LDAP. Step 4: because LDAPServerIntegrity is set to 1 (Negotiate, not Require), the DC accepts the unsigned bind and executes the LDAP modify requested by the attacker. Common payloads: write msDS-AllowedToActOnBehalfOfOtherIdentity for resource based constrained delegation (T1134.001), write a Key Credential for shadow credential abuse (the Whisker / PKINIT technique by Elad Shamir), or set GenericAll on a Tier 0 object. The same flow against ADCS HTTP enrollment (ESC8) produces a DC certificate and full forest takeover. Tools: impacket-ntlmrelayx, PetitPotam.py, Coercer, krbrelayx, Certipy relay, ntlmrelayx with --target ldap and --escalate-user.
Cómo lo evalúa Guerrilla
Guerrilla performs the check in two stages. First, for each DC computer object in CN=Domain Controllers,DC=..., the cmdlet performs a remote registry read against HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity using Get-ItemProperty over WinRM or Remote Registry. Second, the cmdlet enumerates GPOs linked to the Domain Controllers OU via Get-GPInheritance, downloads each linked GPO from \\domain\SYSVOL\domain\Policies\{GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf, and parses the [Registry Values] section for MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity. The check reports the registry value, the GPO value, the linking GPO display name, and any drift between the two. A separate sub-check inspects LDAP channel binding (LdapEnforceChannelBinding under the same key) and surfaces it as ADDOM-014 for LDAPS over TLS. Guerrilla also reviews Directory Service event log IDs 2886, 2887, 2888, and 2889 on each DC where access is granted, which are the Microsoft supplied audit events for unsigned and cleartext LDAP binds.
Valor recomendado
Requisito de firma del servidor LDAP establecido en 'Requerir firma' en todos los DC
Remediación
Configure mediante directiva de grupo: Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Directivas locales > Opciones de seguridad > 'Controlador de dominio: requisitos de firma del servidor LDAP' = 'Requerir firma'. Aplique a la OU Domain Controllers
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8, SC-8(1), SC-23
- CIS Benchmark
- 2.3.5.1
- ANSSI
- R25
- NSA / ASD
- LDAP-1
- CIS AD Benchmark
- 2.1.1
- MITRE ATT&CK
- T1557