ADTRUST-006: Estado de la autenticación selectiva
- Plataforma
- Active Directory
- Categoría
- AD Trust Relationships
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La autenticación selectiva restringe qué usuarios de un dominio de confianza pueden autenticarse en los recursos de su dominio al exigir permisos explícitos en cada recurso. Sin ella, todos los usuarios autenticados del dominio de confianza pueden acceder a cualquier recurso sobre el que tengan permisos, lo que amplía significativamente la superficie de ataque
Por qué importa
A forest trust without selective authentication is functionally equivalent to merging the two forests for authentication purposes. Any compromised user, service account, or computer in the trusted forest can authenticate to any resource in the trusting forest that grants Authenticated Users, Domain Users (via well-known SID translation), or Everyone access. That set is enormous in most environments: file shares with legacy permissions, the SYSVOL share on every DC, IIS sites under Windows Authentication, SQL Server instances with mixed-mode disabled, ADCS web enrollment endpoints, RDP on member servers with the default Remote Desktop Users membership, and WSUS/SCCM consoles. Worse, the trusted forest is by definition outside the trusting forest tier zero perimeter, so a Domain Admin compromise in the trusted forest gives the attacker an Authenticated Users foothold across the trusting forest, which is the precondition for ADCS ESC1/ESC8, NTLM relay to LDAP, BloodHound enumeration, Kerberoasting of every service principal, and any number of credentialed lateral movement primitives. The Mandiant and SpecterOps red team literature consistently shows that the fastest forest-to-forest pivot is not a 0-day, it is a forest trust with selective authentication off and SID filtering quarantined. Microsoft has documented selective authentication as the recommended posture for every inter-organization trust since Windows Server 2003 R2, but it is not the default in the New Trust Wizard and is almost never retrofitted onto trusts that predate the M&A integration that demanded them.
Ruta de ataque
Step 1: Foothold in the trusted forest. The attacker compromises any account in PARTNER.LOCAL, the forest on the trusted side of the trust to CORP.LOCAL. The account does not need to be privileged in PARTNER; a help desk user, a low-tier application service account, or a stale contractor account is sufficient. Step 2: Trust enumeration. From the foothold, the attacker runs nltest /domain_trusts /v or BloodHound with the cross-forest collection method to map every trust. They identify CORP.LOCAL as a trusting forest and pull trustAttributes via an authenticated LDAP query to CORP. The absence of TRUST_ATTRIBUTE_CROSS_ORGANIZATION (0x10) confirms the trust is forest-wide. Step 3: Cross-forest authentication. Because selective authentication is off, the attacker requests a referral TGT from a PARTNER DC for a service in CORP (Kerberos cross-realm ticket via krbtgt of PARTNER signed for CORP). The CORP DC issues a service ticket whose PAC carries S-1-5-11 (Authenticated Users) and not S-1-5-1000 (Other Organization). Every CORP resource that grants Authenticated Users is now reachable. Step 4: Recon on the trusting forest. The attacker enumerates the trusting forest with the cross-forest user context: SharpHound -d corp.local --collectionmethods All, certipy find -u attacker@partner.local -dc-ip <CORP DC>, GetUserSPNs.py against every CORP user. Selective authentication being off means none of these reads are blocked at the DC. Step 5: Exploitation. The attacker finds a CORP ADCS template vulnerable to ESC1, ESC2, ESC3, or ESC8 that grants Domain Users or Authenticated Users enrollment, requests a certificate as a high-privilege CORP user via UPN/SAN supply or the relay primitive, and authenticates to CORP as Domain Admin. Alternatively the attacker locates a CORP file share with Authenticated Users:Read on a folder containing cleartext credentials, a Kerberoastable CORP service account they can crack offline, or a CORP host with unconstrained delegation that allows TGT capture. Any one of these primitives is a forest takeover. The lateral path was opened solely by the missing 0x10 bit on trustAttributes.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain naming context and runs Get-ADObject -SearchBase "CN=System,$((Get-ADDomain).DistinguishedName)" -LDAPFilter "(objectClass=trustedDomain)" -Properties trustAttributes, trustDirection, trustType, trustPartner, securityIdentifier, msDS-TrustForestTrustInfo, whenCreated. For each returned object the check decodes trustAttributes as a bitmask and emits a finding when any of the inter-organization or external trust definitions are present without the TRUST_ATTRIBUTE_CROSS_ORGANIZATION (0x10) flag. Where remote registry or WinRM is available against a DC, the check also calls Get-ADTrust -Filter * and the LSA via [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().GetAllTrustRelationships() to confirm the SelectiveAuthentication boolean exposed by the managed API matches the on-disk attribute. The check enriches each finding with the trustDirection (inbound, outbound, bidirectional), the trust age (whenCreated), the SID filtering state (TRUST_ATTRIBUTE_QUARANTINED_DOMAIN, 0x4), and the count of authentication-capable resources in the trusting forest that grant Authenticated Users (a sample of file shares, ADCS templates, and SPN-bearing accounts) so the operator can scope blast radius before remediation.
Valor recomendado
Autenticación selectiva habilitada en todas las relaciones de confianza de bosque. Permisos de autenticación permitida concedidos únicamente en los recursos necesarios
Remediación
Habilite la autenticación selectiva en las relaciones de confianza de bosque mediante Dominios y confianzas de Active Directory > Propiedades de la relación de confianza > pestaña Autenticación > Seleccione 'Autenticación selectiva'. A continuación, conceda el permiso 'Autenticación permitida' en los objetos de equipo concretos a los que los usuarios externos necesitan acceder
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-4, AC-6
- ANSSI
- R33
- CIS AD Benchmark
- 3.2.3
- MITRE ATT&CK
- T1482, T1078.002