ADSTALE-006: Versiones de SO sin soporte
- Plataforma
- Active Directory
- Categoría
- AD Stale & Obsolete Objects
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los equipos unidos al dominio que ejecutan sistemas operativos que han superado su fecha de fin de soporte (Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012/R2) ya no reciben parches de seguridad regulares. Aunque para algunos pueden estar disponibles actualizaciones de seguridad extendidas, estos sistemas presentan un riesgo elevado y deben identificarse, rastrearse y priorizarse para la migración a plataformas con soporte
Por qué importa
Unsupported operating systems are a force multiplier for almost every Active Directory attack technique. They expose protocols that have been disabled by default for years on supported platforms: SMBv1 (EternalBlue, EternalRomance, MS17-010), legacy NTLM challenge-response without MIC, RC4-HMAC Kerberos enabled by policy, and TLS 1.0 / 1.1 cipher suites. They lack Credential Guard, which means LSASS plaintext credential material and Kerberos TGTs are recoverable with stock Mimikatz. They predate LSA Protection (RunAsPPL), so SeDebugPrivilege is sufficient to read the process. They are not eligible for Windows Defender ASR rules, AMSI integration in PowerShell 5.1+, or modern WDAC enforcement. Server 2008 R2 and earlier domain controllers cannot enforce LDAP signing and channel binding correctly when interoperating with newer clients, which directly enables NTLM relay paths against ADCS HTTP enrollment (PetitPotam, CVE-2021-36942) and against LDAP. Any one of these systems on a domain-joined network reintroduces removed attack surface for the entire forest, not just for itself: a compromised Server 2012 R2 file server holds the same Kerberos tickets that any 2022 server would, and an attacker who lands code execution there pivots laterally using techniques the rest of the estate has been patched against. ESU coverage mitigates publicly disclosed CVEs but does not restore the missing architectural controls.
Ruta de ataque
Step 1: Discovery. The attacker, holding any domain credential, queries Active Directory for legacy operating systems: Get-ADComputer -Filter 'OperatingSystem -like "*2008*" -or OperatingSystem -like "*2012*" -or OperatingSystem -like "*Windows 7*"' -Properties OperatingSystem, OperatingSystemVersion, LastLogonDate. The same enumeration is built into BloodHound (the OperatingSystem property is collected by SharpHound) and into adPEAS and AD security assessment tooling output. No elevated rights are required. Step 2: Reachability. The attacker scans the discovered hosts for legacy services: SMBv1 (port 445 with SMB1 negotiated), RDP without NLA, WinRM with Basic auth, RPC endpoints exposing MS-RPRN (Print Spooler) or MS-EFSR (EFSRPC / PetitPotam), and LDAP without signing. nmap --script smb-protocols and Impacket rpcdump.py enumerate the surface. Step 3: Exploitation. The attacker picks the cheapest primitive. EternalBlue (MS17-010, CVE-2017-0144) yields SYSTEM on any unpatched Server 2008 R2 or Windows 7 host that exposes SMBv1; metasploit ms17_010_eternalblue or AutoBlue is point and click. Server 2008 R2 and 2012 R2 without the May 2022 ESU patches remain vulnerable to PrintNightmare (CVE-2021-34527) for SYSTEM code execution via the Print Spooler service. Even with ESU, Server 2012 R2 lacks the post-2023 NTLM hardening and is therefore an easy NTLM relay coercion target via PetitPotam (CVE-2021-36942) into ADCS HTTP enrollment. Step 4: Credential extraction. Without Credential Guard, the attacker runs Mimikatz sekurlsa::logonpasswords against the LSASS process and recovers cleartext passwords for every interactive logon since boot, plus NTLM hashes and Kerberos TGTs for any service account that has executed locally. On a member server this typically yields a service account that is a member of a privileged group elsewhere; on a DC running Server 2008 R2 it yields the krbtgt hash directly. Step 5: Lateral movement and persistence. Recovered hashes are sprayed via pass-the-hash to modern hosts (which accept the same NTLM authentication), recovered TGTs are replayed via pass-the-ticket, and the legacy host becomes the staging point for golden-ticket forging if a DC was compromised. The unsupported OS is no longer the target; it is the launchpad.
Cómo lo evalúa Guerrilla
Guerrilla performs a paged LDAP search against the default naming context for (&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) and requests the attributes operatingSystem, operatingSystemVersion, operatingSystemServicePack, dNSHostName, lastLogonTimestamp, pwdLastSet, whenCreated, and userAccountControl. operatingSystemVersion is parsed into a (major, minor, build) tuple. The tuple is matched against an embedded lifecycle table sourced from learn.microsoft.com/lifecycle: any version whose end-of-extended-support date is earlier than the scan date is flagged. Server SKUs are differentiated from client SKUs by the operatingSystem string ("Server" substring) and by the userAccountControl SERVER_TRUST_ACCOUNT / WORKSTATION_TRUST_ACCOUNT bits. Domain controllers are identified separately by enumerating the nTDSDSA objects under CN=Sites,CN=Configuration and joining on serverReference. The check produces a per-object record with severity weighted by role (DC > member server > workstation), by recency of lastLogonTimestamp (active hosts are weighted higher than dormant), and by ESU availability for the matched OS. The output also surfaces the count of distinct legacy versions so the operator can prioritise the migration backlog.
Valor recomendado
Ningún equipo que ejecute sistemas operativos sin soporte, salvo que estén cubiertos por actualizaciones de seguridad extendidas con un plan de migración documentado
Remediación
Consulte las cuentas de equipo por el atributo operatingSystem para identificar versiones de SO sin soporte. Determine qué sistemas están cubiertos por actualizaciones de seguridad extendidas (ESU). Cree cronogramas de migración para todos los sistemas sin soporte. Implemente controles compensatorios para los sistemas que no puedan actualizarse de inmediato: segmentación de red, supervisión mejorada, acceso restringido a servicios. Realice un seguimiento del progreso frente a los cronogramas de migración
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-2
- ANSSI
- R03
- CIS AD Benchmark
- 9.3.2
- MITRE ATT&CK
- T1210