Active Directory (AD) & Domain

[TimmyBugcrowd]

Hi,

I'm opening this issue to propose adding Active Directory (AD) & Domain vulnerabilities to the VRT. Below are suggested entries and short justifications:

Active Directory (AD) & Domain > Anonymous FTP Servers > Varies
Anonymous FTP on internal AD networks can expose sensitive files or scripts, aiding attackers in lateral movement or privilege escalation. While not inherently critical, it presents a clear misconfiguration in AD environments that weakens internal defenses.

Active Directory (AD) & Domain > Anonymous SMB File Shares > Varies
Exposing SMB shares without authentication in a domain environment often leaks sensitive credentials, configuration files, or scripts. This significantly aids internal recon and privilege escalation, making it more impactful than a typical file disclosure.

Active Directory (AD) & Domain > Hosts Vulnerable to PetitPotam Attacks > P1
PetitPotam can force NTLM authentication to a relay server, enabling full domain compromise via AD CS abuse or credential relay. It’s highly exploitable and has been weaponized in real-world attacks, warranting critical severity.

Active Directory (AD) & Domain > LDAP Anonymous Bind > P2
Allowing anonymous LDAP binds in AD exposes directory structure and user data, which supports recon for privilege escalation or lateral movement. Though not immediately exploitable, it's a dangerous misconfiguration in enterprise environments.

Active Directory (AD) & Domain > LLMNR Poisoning > P2
LLMNR allows credential capture through spoofed responses, letting attackers steal NTLM hashes in AD environments. It’s a well-documented, impactful vector in internal attack chains, especially when paired with relay tools.

Active Directory (AD) & Domain > NULL Sessions on Domain Controller > P3
NULL sessions on DCs give unauthenticated access to sensitive data like user lists and shares. This is a severe AD misconfiguration that facilitates recon and lays groundwork for privilege escalation or lateral movement.

Active Directory (AD) & Domain > NetBIOS Poisoning > P3
Similar to LLMNR, NetBIOS spoofing can capture hashes or redirect traffic internally. While its impact is limited on hardened networks, it's still a viable vector in poorly segmented AD setups.

[Stuart-bc]

Hi @TimmyBugcrowd - Looking at this I think some of these would be better in a wider category than AD & Domain - e.g. Anon FTP and SMB would fit better in Insecure data storage - as both those issues can be found on general network tests, without a domain controller.

I also think we will need a subcategory for the AD issues as there are a lot - but I will ask for a review against the methodology to determine what makes sense here.

[RRudder]

Here are some other pen test related categories that were proposed previously @Stuart-bc. Please let me know which ones make sense to incorporate:

• Broken Authentication and Session Management - Excessive JSON Web Token Lifetime
• Broken Authentication and Session Management - Secret Questions Used for Account Verification
• Insufficient Security Configurability - Business Logic Bypass
• Insufficient Security Configurability - No 2FA
• Insufficient Security Configurability - No Account Lockout
• Insufficient Security Configurability - Weak JSON Web Token Hashing Algorithm
• Sensitive Data Exposure - Sensitive Information Disclosed in JSON Web Token
• Sensitive Data Exposure - Sensitive Information Disclosure Robots.txt
• Server Security Misconfiguration - Fingerprinting Banner Disclosure - Software Versions Disclosed in Response Headers
• Server Security Misconfiguration - Misconfigured Security Headers - Insecure Content Security Policy
• Using Components with Known Vulnerabilities - Unpatched Javascript Libraries

These were raised in Template Repo PRs #540, #541, #542.

[Phishician]

+1 on Stuart's point about FTP and SMB not being included in the AD parent category. These are issues that can be found on internal network tests and are not specific to AD. Also agree with the need for subcategories within AD - this is a must as the VRT will obviously grow beyond the findings mentioned above. It will also make it easier for researchers to navigate.

Issues like LLMNR and NetBIOS poisoning are also not AD specific. These should be grouped together under something like "Name Resolution Poisoning".

Issues like "Hosts Vulnerable to PetitPotam Attacks" should not fall directly under the AD category. It should look something like AD > Authentication Coercion > NTLM Coercion.

[binbashsu-bugcrowd]

Closing this Issue and tracking more closely within #501