ADDOM-013: LDAP Signing Requirements
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Critical
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla enumerates every domain controller via the Domain Controllers OU and the configuration partition (CN=Sites,CN=Configuration,DC=...), then queries the registry value HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity on each DC. The value is a REG_DWORD: 0 = None, 1 = Negotiate signing (the historical default that does NOT actually require signing), 2 = Require signing. The check also reads the resultant Group Policy setting "Domain controller: LDAP server signing requirements" from the Default Domain Controllers Policy (or any GPO linked to the Domain Controllers OU) by parsing the GptTmpl.inf file in the SYSVOL GPO folder and the corresponding security database. A DC fails when LDAPServerIntegrity is not present, is 0, or is 1. The check also verifies that the GPO setting matches the runtime registry value to surface drift caused by a local override or a missed gpupdate.
Por qué importa
Unsigned LDAP is the single most reliable cross-protocol relay sink in a modern Active Directory environment. An attacker who can coerce authentication from any computer account (PetitPotam, PrinterBug via MS-RPRN, DFSCoerce, or the recently disclosed Authentication Coercion variants) can forward that NTLM authentication to a domain controller over LDAP or LDAPS and, because the bind is unsigned, the DC accepts the relayed session and acts on the attackers behalf. With write access via the relayed session the attacker can grant DCSync rights (T1003.006), add a computer to a privileged group, write a shadow credential to msDS-KeyCredentialLink for an account they control, or in combination with an Enterprise CA write an enrollment for a domain controller certificate that yields persistent Tier 0 access. The blast radius is the entire domain: a single coerced print spooler on any unprivileged host plus an unsigned LDAP listener on any DC is sufficient to take over the directory. Microsoft acknowledged this in advisory ADV190023 and shipped channel binding and signing controls in the March 2020 LDAP signing servicing baseline.
Ruta de ataque
The standard kill chain is well documented. Step 1: the attacker establishes a listener on the local network using impacket-ntlmrelayx with the target set to ldap://dc01.contoso.local or ldaps://dc01.contoso.local, with an action such as --escalate-user attacker, --add-computer, --shadow-credentials, or --delegate-access. Step 2: the attacker coerces authentication from any machine account in the domain, typically with PetitPotam (CVE-2021-36942), PrinterBug, or DFSCoerce, by calling the EfsRpcOpenFileRaw, RpcRemoteFindFirstPrinterChangeNotificationEx, or NetrDfsRemoveStdRoot RPC against a target host with credentials referencing the attacker UNC path. Step 3: the target machine account NTLM authenticates to the attacker, who relays the unsigned NTLM session to the DC over LDAP. Step 4: because LDAPServerIntegrity is set to 1 (Negotiate, not Require), the DC accepts the unsigned bind and executes the LDAP modify requested by the attacker. Common payloads: write msDS-AllowedToActOnBehalfOfOtherIdentity for resource based constrained delegation (T1134.001), write a Key Credential for shadow credential abuse (the Whisker / PKINIT technique by Elad Shamir), or set GenericAll on a Tier 0 object. The same flow against ADCS HTTP enrollment (ESC8) produces a DC certificate and full forest takeover. Tools: impacket-ntlmrelayx, PetitPotam.py, Coercer, krbrelayx, Certipy relay, ntlmrelayx with --target ldap and --escalate-user.
Cómo lo evalúa Guerrilla
Guerrilla performs the check in two stages. First, for each DC computer object in CN=Domain Controllers,DC=..., the cmdlet performs a remote registry read against HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity using Get-ItemProperty over WinRM or Remote Registry. Second, the cmdlet enumerates GPOs linked to the Domain Controllers OU via Get-GPInheritance, downloads each linked GPO from \\domain\SYSVOL\domain\Policies\{GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf, and parses the [Registry Values] section for MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity. The check reports the registry value, the GPO value, the linking GPO display name, and any drift between the two. A separate sub-check inspects LDAP channel binding (LdapEnforceChannelBinding under the same key) and surfaces it as ADDOM-014 for LDAPS over TLS. Guerrilla also reviews Directory Service event log IDs 2886, 2887, 2888, and 2889 on each DC where access is granted, which are the Microsoft supplied audit events for unsigned and cleartext LDAP binds.
Valor recomendado
LDAP server signing requirement set to 'Require signing' on all DCs
Remediación
Configure via Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > 'Domain controller: LDAP server signing requirements' = 'Require signing'. Apply to the Domain Controllers OU
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8, SC-8(1), SC-23
- CIS Benchmark
- 2.3.5.1
- ANSSI
- R25
- NSA / ASD
- LDAP-1
- CIS AD Benchmark
- 2.1.1
- MITRE ATT&CK
- T1557