1. Home
  2. System Vulnerabilities
  3. How to remediate – AD Starter Scan – Dangerous Trust Relationship
Searching...

How to remediate – AD Starter Scan – Dangerous Trust Relationship

Contents

1. Introduction

The vulnerability “AD Starter Scan – Dangerous Trust Relationship” indicates a misconfigured outbound trust relationship in Active Directory that lacks security mechanisms. This allows attackers to move sideways within an AD environment, potentially gaining access to sensitive data and systems. Affected systems are typically smaller Active Directory deployments with up to 5000 users, groups or machines. Impact is likely on confidentiality, integrity, and availability due to potential for unauthorized access and modification of resources.

2. Technical Explanation

The vulnerability occurs when a trust relationship between AD domains isn’t secured with appropriate protections. Attackers can exploit this by leveraging weak authentication or exploiting known vulnerabilities like ‘printer bug’. The preconditions include having an existing outbound trust relationship configured without security measures in place. An attacker could, for example, use SID history injection to impersonate users from the trusted domain and gain access to resources on the trusting domain.

  • Root cause: Lack of security mechanisms (SID filter quarantining or protections against ‘printer bug’) activated on an outbound trust relationship.
  • Exploit mechanism: Attackers can exploit the trust relationship using techniques like SID history injection or exploiting vulnerabilities in the authentication process, such as the ‘printer bug’.
  • Scope: Active Directory deployments with up to 5000 users, groups or machines. Incomplete results may be returned for larger AD deployments.

3. Detection and Assessment

Confirming vulnerability involves checking trust relationship configurations. A quick check is reviewing the trust properties in Active Directory Users and Computers. A thorough method is using Nessus scans with the AD Starter Scan plugins.

  • Quick checks: Open Active Directory Users and Computers, navigate to the trust relationship, and verify if SID filter quarantining is enabled or selective authentication/TGT delegation are configured.
  • Scanning: Nessus scan with “AD Starter Scan – Dangerous Trust Relationship” plugin ID 16879. This should be used as an example only.
  • Logs and evidence: Review the Security event logs on domain controllers for failed authentication attempts related to the trust relationship. Look for Event IDs associated with Kerberos or NTLM authentication failures.
nltest /trustdomain

4. Solution / Remediation Steps

Fixing this issue requires enabling security mechanisms on the outbound trust relationship. The steps are small and testable, ensuring minimal disruption.

4.1 Preparation

  • No services need to be stopped for this remediation.

4.2 Implementation

  1. Step 1: Open Active Directory Users and Computers.
  2. Step 2: Navigate to the trust relationship in question.
  3. Step 3: Right-click the trust and select “Properties”.
  4. Step 4: Go to the “Security” tab.
  5. Step 5: Enable “Require SID filter quarantining for this trust”.
  6. Step 6: Return to the properties window, go to the “Advanced” tab.
  7. Step 7: Configure either “Selective authentication” or disable TGT delegation.
  8. Step 8: Apply and OK the changes.

4.3 Config or Code Example

Before

No security settings enabled on trust relationship.

After

SID filter quarantining is enabled, and either Selective authentication or TGT delegation are configured.

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability include least privilege and secure defaults. Least privilege limits the impact if a trust relationship is compromised. Secure defaults ensure new trusts are created with appropriate security settings.

  • Practice 1: Implement least privilege by granting only necessary permissions to users and groups accessing resources through the trust relationship.
  • Practice 2: Enforce secure defaults for all Active Directory configurations, including outbound trust relationships, ensuring SID filter quarantining is enabled by default.

4.5 Automation (Optional)

PowerShell can be used to automate this process, but caution is advised when modifying AD configurations.

# Example PowerShell script (use with caution):
# Get-ADTrust -Identity "YourTrustName" | Set-ADTrust -SidFilteringEnabled $true

5. Verification / Validation

  • Post-fix check: Open Active Directory Users and Computers, navigate to the trust relationship, and verify that “Require SID filter quarantining for this trust” is checked and either “Selective authentication” or TGT delegation are configured.
  • Re-test: Re-run the Nessus scan with the “AD Starter Scan – Dangerous Trust Relationship” plugin ID 16879 to confirm the vulnerability is no longer detected.
  • Smoke test: Verify a user from the trusted domain can access resources on the trusting domain, and vice versa.
  • Monitoring: Monitor Security event logs for authentication failures related to the trust relationship as an early warning sign of issues.
nltest /trustdomain | findstr "Trust Relationship"

6. Preventive Measures and Monitoring

Update security baselines to include secure trust configurations. Implement CI/CD pipelines with checks for AD configuration compliance. Establish a regular patch and config review cycle.

  • Baselines: Update your Active Directory security baseline or Group Policy Objects (GPOs) to enforce SID filter quarantining on all outbound trust relationships.
  • Pipelines: Add automated checks in CI/CD pipelines to verify that new or modified trust relationships meet the required security standards.
  • Asset and patch process: Implement a regular review cycle for Active Directory configurations, including trust relationships, to identify and remediate any misconfigurations promptly.

7. Risks, Side Effects, and Roll Back

Enabling SID filter quarantining may cause compatibility issues with older applications that don’t support it. Disabling TGT delegation can impact functionality for certain services. Roll back by disabling the changes made to the trust relationship configuration.

  • Roll back: Open Active Directory Users and Computers, navigate to the trust relationship, uncheck “Require SID filter quarantining for this trust”, and re-enable TGT delegation if previously disabled.

8. References and Resources

Was this article helpful?

Yes No

Related Articles