search

davidprowe / BadBlood

BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.
https://www.secframe.com/badblood
GNU General Public License v3.0
2.06k stars 274 forks source link

Feature suggestion: training feedback via known-good state of domain #4

Closed architect00 closed 4 years ago

architect00 commented 4 years ago

Hi David,

I stumbled upon your tool while searching for training resources for blue teamers. I love the idea of creating a deliberately vulnerable Active Directory environment. I would like to discuss a feature suggestion:

It would be interesting to work towards a known-good state of the domain. A predefined state of how the domain should look like in the end. This way trainees can reflect on gaps of their applied changes and the predefined result of the known-good state.

Usage of BadBlood in training sessions would look like this:

  1. Generate objects of known-good state in domain
  2. Apply randomize*-Scripts
  3. Trainee starts discovering domain
  4. Trainee applies changes to domain
  5. End training session, run check script / reflect on coverage of changes

I guess the problem on implementing a known-good state is, that the domain objects are not setup with any special permissions at the beginning. According to the current code in InvokeBadBlood.ps1 the permissions are set in the last step (https://github.com/davidprowe/BadBlood/blob/1693bee1089f5d24ded8ee50ac01e43bc9455589/Invoke-BadBlood.ps1#L97). This means the freshly generated AD-Objects before this line have no special permission setup and the setup does not represent any real world experience.

What do you think about this feature?

davidprowe commented 4 years ago

Sounds like you would be looking for an automated active directory training class. Its a very nice end goal to have for any tool. I'd love to be able to provide AD training as a SaaS.

architect00 commented 4 years ago

That is exactly what this feature is about.

In order to start out I would use this list https://www.cert.ssi.gouv.fr/uploads/guide-ad.html and generate a domain, which meets the requirements of the assessment checks. Afterwards BadBlood Core manipulates the objects. This procedure (secure->insecure) is often used in creating CTF challenges to ensure that a vulnerability can only be exploited in a predefined way.

Concrete Example

Manipulating Kerberos DES_KEY options

Goal

Find users with USE_DES_KEY_ONLY set and remove it.

With that being said, I would love to support/help and see this being made.