## Group Policy

Windows Group Policy (Group Policy) is a management tool for the Microsoft Windows operating system that enables centralized management of an organization's computer and user settings. Group Policies can be used to define various settings, restrictions, and security configurations that affect computers and users who are part of a specific Active Directory domain.

The main purpose of group policies is to facilitate system administration, as they allow for the configuration of complex settings in one centralized location. This saves time and effort, as there is no need to make the same changes individually for each computer or user.

---

## Preventing Pass the Hash attack

In this simulated penetration testing, a significant number of weaknesses and vulnerabilities have been detected. Let's now switch gears and fix one of them, namely allowing local logins over the network. This should be prevented using a group policy object (GPO)

The purpose is to create a group policy that states the following: "Local users are not allowed to log in to this domain's Windows servers over the network". Therefore, even if all servers have the same NTLM hash and it leaks from one server, it cannot be used for logging in to another server with a *local* user.

---

## Defining a local user

In Windows (currently, specifically for this purpose), there are two groups that can be used to separate local users.

- S-1-5-113: NT AUTHORITY\\Local account
- S-1-5-114: NT AUTHORITY\\Local account and member of Administrators group

In this example, we use the first "Local account". However, it is good to know that in some networks, you may encounter a situation where network login cannot be blocked for every user. For example, Microsoft has noted that failover clustering uses a local user named CLIUSR over the network.

---

## Remote Desktop Connection (RDP)

Start by opening a remote desktop connection (RDP, Remote Desktop Protocol) to the domain controller (DC1). You can find the IP address below, and you already know the username and password. Provide the username in the format **john.doe@evilcorp.local**.

If you haven't used remote desktop yet, it's simple.

#### Windows:

1. Open the "Start" menu and type "Remote Desktop Connection" or "Etätyöpöytäyhteys" in the search field.
1. Select the "Remote Desktop Connection" application from the results.
1. Write the IP address or network name of the remote machine in the "Computer" field.
1. Select "Connect".
1. Provide the username and password for the remote machine when prompted.
1. The connection opens and you can access the remote desktop.

#### Mac:

1. Open "Finder" and navigate to the "Applications" folder.
1. Search for "Microsoft Remote Desktop" application and open it.
1. Select "Connections" -> "PC Quick Connect".
1. Write the IP address or network name of the remote machine in the "PC Name" field.
1. Provide the username and password for the remote machine when prompted.
1. The connection opens and you can use the remote desktop.

#### Ubuntu (Remmina):

1. Open the "Remmina" application.
1. Click on the "+" icon and select "Desktop".
1. Enter the IP address or network name of the remote machine to the "Server" field.
1. Select "Protocol" and choose "RDP - Remote Desktop Protocol".
1. Enter the remote machine username "User name" into the User name field.
1. Click "Connect" (Yhdistä).
1. Provide the password for the remote machine when prompted.
1. The connection opens and you can access the remote desktop.

---

## Server Manager

When you open the remote desktop connection, open the "Server Manager" management console from the Windows start menu.

![](sanity:image-6b711e81ef2503fdf824cff406fbb8d77c500733-860x502-png)

---

## Group Policy Management

Then open the "Group Policy Management" console from the "Tools" menu.

![](sanity:image-0147ab230768f89000fd9ab62b43c4bba4cb78cf-1134x774-png)

---

## Default Domain Policy

Click "Forest: evilcorp.local" -> "Domains" -> "evilcorp.local" -> "Default Domain Policy" with the right mouse button and select "Edit".

![](sanity:image-ba9ec86f9cd88218007db4bbc9368fba4b4dcd46-926x326-png)

---

## Deny access to this computer from the network

Search for "Computer configuration" -> "Policies" -> "Windows Settings" -> "Security Settings" -> "Local Policies" -> "User Rights Assignment" -> "Deny access to this computer from the network" and double click to open it.

![](sanity:image-86fc1b317a68a16d76bc765c0514e377af1e32fd-1784x518-png)

Click on "Define these policy settings", select "Add User or Group", type in "Local account" in the field and press "OK" and then "OK" again.

![](sanity:image-3f06132af53df4e4f881ec3f871c45924ddc47cc-980x564-png)

Group policy is now ready and active.

![](sanity:image-8d8a97314612f43a6e08e0a131bc0e2a0cd12d6c-1076x162-png)

---

## The attack still works on DC1!

Now the hardening that has been done is extremely useful. If the company's network has servers that have a local user with the same password, the NTLM hash of one local user cannot be used to spread to other servers.

**However**, is the Administrator user of DC1 definitely a local user? The answer is no. Domain controllers are slightly different from other servers. When a Windows server is promoted to a domain controller, its local Administrator account suddenly becomes a "Domain Admin" account for the domain.

For this reason, this GPO, although it was good to do, does not help in this particular case, where evilcorp.local/Administrator and IIS1/Administrator have the same password.

Therefore, we also need to change the password for the user evilcorp.local/Administrator.

---

## Changing Administrator User Password

Open again "Server Manager" and this time select "Active Directory Users and Computers".

![](sanity:image-5b0c2005e4b35de55a051a19700fce1c8fd5795e-932x462-png)

Select Users -> Administrator, click on the right and choose "Reset Password".

![](sanity:image-11639fd0a402bf584129aa4171f2c0b71b224fbc-982x468-png)

Set a new, secure password for the user and click "OK".

![](sanity:image-7c26d5d239cf96d469eac91118aa4939e8f70850-754x494-png)

---

## Exercise

Perform the cybersecurity hardening as described. Then run C:\\Check.ps1 to verify the fixes. If the GPO is configured correctly and the password has been changed as required, the script should output the password for you. If the script prompts for an "Execution Policy Change" modification, answer "Y".

![](sanity:image-47794fc3284bb4579623575f374dcee53c288361-1212x560-png)

@exercise 514c148e39d7

@exercise 6e74efb502ef


This is a scenario, please do not unnecessarily close it within the same course area (Scenario 1) so that you do not lose your progress. Please add time if necessary. It may take a few minutes for the scenario to start, please wait patiently.

Evilcorp - Scenario 1

RDP, Group Policy (GPO) and Pass the Hash mitigation

Windows and Active Directory attacks and defense

Windows is widely used in the IT environments of numerous companies and educational institutions, and Windows networks are typically managed through an Active Directory domain.

In this course, we will explore the security of the Windows operating system and Active Directory from the perspectives of both attackers and defenders. Some of the tasks involve attacks, while others are hardening tasks.

The scope of the course (Windows, attack and defense) is quite broad. If one were to study it purely in theory, the course would be dull. On the other hand, without any theory, there would be no hacking because both attack and defense rely on understanding what is happening.

We chose, for these reasons, to implement the course using a scenario-based approach, where each section of the course deals with one "scenario" that may include a few attacks, a few tools, and a few hardenings to protect against the attacks.

The theory is covered in small pieces in practical context, always when necessary. Things are tried to be understood at the bit level in order to avoid the unfortunate phenomenon typical of such courses where the student knows how to try the psexec attack after obtaining the NTLM hash, but does not understand at all what the attack does and how it works (spoiler: psexec is based on the Service Control Manager RPC interface, which launches the desired command as a Windows service on the target server). Let's peek under the hood with Wireshark and dig into the source code of modules, for example, Metasploit.

This way, a comprehensive and theoretical topic will hopefully become fun and easily approachable step by step.

Are you ready to break into EvilCorp's corporate network?

The course does not require knowledge of Windows environments, but otherwise basic things like Linux, computer networks, nmap, etc. would be good to have. Welcome to the course!

This course is still under construction, more scenarios will be added.

This course is in BETA mode, please let us know if you come across any misaligned bits.

RDP, Group Policy (GPO) and Pass the Hash mitigation

Learn to hack — start here