Feature suggestion: training feedback via known-good state of domain about badblood HOT 2 CLOSED

Sounds like you would be looking for an automated active directory training class. Its a very nice end goal to have for any tool. I'd love to be able to provide AD training as a SaaS.

from badblood.

That is exactly what this feature is about.

In order to start out I would use this list https://www.cert.ssi.gouv.fr/uploads/guide-ad.html and generate a domain, which meets the requirements of the assessment checks. Afterwards BadBlood Core manipulates the objects. This procedure (secure->insecure) is often used in creating CTF challenges to ensure that a vulnerability can only be exploited in a predefined way.

Concrete Example

Manipulating Kerberos DES_KEY options

• Generate User objects
• Apply secure settings ensure USE_DES_KEY_ONLY is unset in AccountControl
• Apply BadBlood ensure USE_DES_KEY_ONLY is set in AccountControl

Goal

Find users with USE_DES_KEY_ONLY set and remove it.

With that being said, I would love to support/help and see this being made.

from badblood.