ADSTALE-005: Obsolete OS Computers
- Plataforma
- Active Directory
- Categoría
- AD Stale & Obsolete Objects
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check binds to the default domain naming context and runs an LDAP query against (&(objectCategory=computer)(operatingSystem=*)) requesting operatingSystem, operatingSystemVersion, operatingSystemServicePack, dNSHostName, lastLogonTimestamp, pwdLastSet, and userAccountControl. Each returned object is matched against a deny-list of obsolete operatingSystem strings: "Windows XP*", "Windows Server 2003*", "Windows Vista*", "Windows Server 2008*" (which covers both 2008 and 2008 R2), and the legacy "Windows 2000*" string. Computers with an empty operatingSystem attribute are not flagged here (they are handled by ADSTALE-002 inactive-computer logic). For each match the check also evaluates the DISABLED bit (0x00000002) in userAccountControl and the lastLogonTimestamp (converted from FILETIME), so the finding can distinguish a confirmed active obsolete host from an orphaned disabled object. The output enumerates the distinguishedName, operatingSystem string, operatingSystemVersion, days since last logon, and enabled / disabled state for every flagged computer.
Por qué importa
Obsolete Windows builds receive zero security updates from Microsoft outside of paid Extended Security Update contracts, which are bounded in time and were never offered for XP, 2003, or Vista. Every CVE published after the EOL date remains permanently exploitable on these hosts. The catalog includes wormable remote-code-execution bugs that require no authentication: MS17-010 / EternalBlue (CVE-2017-0143 through 0148) on SMBv1, MS08-067 on the Server service, BlueKeep (CVE-2019-0708) on RDP for XP, 2003, 7, and 2008. Beyond the unpatched primitives, these platforms cannot host the security controls that the rest of the modern Windows fleet relies on: no Credential Guard (requires Windows 10 / Server 2016+ with VBS), no LSA Protection (RunAsPPL was introduced in Windows 8.1 / Server 2012 R2), no LAPS agent on XP / 2003, no Windows Defender ATP / Defender for Endpoint sensor, no modern TLS by default, no SMB signing required, no AES-only Kerberos enforcement (RC4 is mandatory). Once an attacker lands SYSTEM on an obsolete host they harvest cached domain credentials, machine-account Kerberos keys, and any service account secrets the host runs under, then pivot laterally with stolen tickets or hashes. A single 2008 R2 print server or 2003 line-of-business box becomes the staging ground for forest-wide compromise, and the ransomware case history (WannaCry, NotPetya, Ryuk, Conti) is overwhelmingly seeded on exactly these unpatched legacy estates.
Ruta de ataque
Step 1: External or internal reconnaissance. The attacker authenticates with any low-privilege domain account (or runs unauthenticated SMB / RDP scans from a foothold subnet) and queries Active Directory for computers with obsolete operatingSystem values. The same LDAP filter Guerrilla uses is trivially reproducible: Get-ADComputer -Filter { operatingSystem -like "Windows Server 2008*" -or operatingSystem -like "Windows Server 2003*" -or operatingSystem -like "Windows XP*" -or operatingSystem -like "Windows Vista*" } -Properties operatingSystem, dNSHostName. No elevated rights are required, every authenticated user can read these attributes by default. Step 2: Vulnerability confirmation. The attacker runs a targeted scan against the flagged hosts using Metasploit auxiliary/scanner/smb/smb_ms17_010, nmap --script smb-vuln-ms17-010, or CrackMapExec smb <target> -M ms17-010. RDP-exposed 2003 / 2008 hosts are tested for BlueKeep with rdpscan. Step 3: Exploitation. The attacker delivers an unauthenticated RCE payload, most commonly MS17-010 (EternalBlue) via the original NSA exploit chain or the Metasploit module exploit/windows/smb/ms17_010_eternalblue, dropping a SYSTEM shell. BlueKeep delivers an equivalent SYSTEM payload on RDP-exposed hosts. MS08-067 still works on unpatched 2003 and XP. Step 4: Credential harvest. From SYSTEM the attacker dumps lsass with Mimikatz sekurlsa::logonpasswords or comsvcs.dll MiniDump. On XP, 2003, and 2008-era hosts WDigest is enabled by default and stores cleartext passwords in memory. The attacker also extracts the machine-account hash from the SECURITY hive (reg save HKLM\SECURITY) and any service-account secrets from HKLM\SECURITY\Policy\Secrets via secretsdump.py. Step 5: Lateral movement. With harvested cached domain credentials, NTLM hashes, or Kerberos tickets the attacker pivots to Tier 1 or Tier 0 hosts. The machine-account hash of an obsolete server is itself a primitive: silver tickets, S4U2Self / S4U2Proxy abuse, or unconstrained-delegation ticket capture if the host is configured for unconstrained delegation (a very common pattern on legacy print and file servers). Step 6: Persistence and impact. The attacker installs a backdoor on the obsolete host (it has no EDR sensor and weak / absent logging), then escalates to a domain controller via the stolen credentials. The unmanaged host is now both the initial entry point and the long-term persistence anchor.
Cómo lo evalúa Guerrilla
Guerrilla performs a single paged LDAP search under the default naming context against (&(objectCategory=computer)(operatingSystem=*)) requesting operatingSystem, operatingSystemVersion, operatingSystemServicePack, lastLogonTimestamp, pwdLastSet, userAccountControl, dNSHostName, and whenCreated. The result set is matched against a static deny-list of obsolete OS strings (Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows Server 2008 R2). For each match the check converts the FILETIME lastLogonTimestamp to a UTC datetime and computes days-since-last-logon, then inspects bit 0x2 of userAccountControl to determine whether the account is enabled. A finding is raised for any enabled match regardless of last-logon recency (a disabled obsolete object is downgraded to informational). Guerrilla optionally probes dNSHostName with Test-Connection or a TCP 445 / 3389 reachability test to confirm the host is online, but the LDAP attribute alone is sufficient to raise the finding because the operatingSystem string is written by the host itself during domain join and during netlogon password rotation, which means a non-empty value is a strong signal of recent presence.
Valor recomendado
No computers running Windows XP, Server 2003, Vista, or Server 2008 joined to the domain
Remediación
Query computer accounts by operatingSystem attribute to identify obsolete OS versions. Verify that identified systems are still active using lastLogonTimestamp and ping tests. Create a migration plan to upgrade or replace obsolete systems. For systems that cannot be immediately upgraded, implement network isolation using VLANs and firewall rules. Disable computer accounts for confirmed decommissioned systems
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-2, CM-6
- ANSSI
- R03
- CIS AD Benchmark
- 9.3.1
- MITRE ATT&CK
- T1210