Intranet Security: From Beginner to Prison—Fundamentals—Basic Intranet Knowledge

Intranet Security: From Beginner to Prison—Fundamentals—Basic Intranet Knowledge
- Intranet Penetration Testing Fundamentals

Intranet Penetration Testing Fundamentals

First of all, this article is basically a set of study notes.

Introduction to Basic Terminology

Workgroup

A workgroup (Work Group) is the most common, simplest, and most basic resource-management model. It places different computers into different groups according to their functions to facilitate management.
Simply put, a workgroup is a circle of computers on a LAN. Everyone in this circle is equal and can come and go freely, with essentially no restrictions. To me, it feels like little more than the name of an organization, without any real management capabilities.

Domain

A domain is a collection of computers with a security boundary. Computers within the same domain have established trust relationships with one another, so accessing other machines in the domain no longer requires permission from the machine being accessed.
Compared with a workgroup, a domain adds management and authentication capabilities, making it more intelligent and secure.

Active Directory (AD)

Active Directory (AD) refers to the component that provides directory services in a domain environment.
Active Directory primarily provides the following functions.
 Centralized account management: All accounts are stored on the server, making it possible to reset accounts, reset passwords, and so on.
 Centralized software management: Software can be deployed uniformly, network printers can be installed, and so on. Software distribution policies can be used to distribute software, allowing
users to choose which software they want to install.
 Centralized environment management: Client desktops, IE, TCP/IP protocol settings, and so on can be configured uniformly.
 Enhanced security: Antivirus software and scanning tasks can be deployed uniformly, users’ computer permissions can be centrally managed, and unified user
password policies can be established. The network can be monitored, and data can be managed centrally.
 Greater reliability and shorter downtime: For example, Active Directory can be used to control user access permissions, while technologies such as clustering and load balancing
can be used to configure disaster recovery for file servers. This provides greater reliability and shorter downtime.

DC: Domain Controller

A domain controller (Domain Controller, DC) is where Active Directory is stored. A computer on which Active Directory (AD) is installed is called a domain controller. When Active Directory is installed for the first time, the computer on which it is installed becomes the domain controller, commonly abbreviated as “DC.”
It is similar to an administrator’s computer within a domain. The domain controller is responsible for authenticating every connected computer and user. It can control computers in the domain and determine whether a computer belongs to the domain.

DNS Server

DNS (Domain Name Server) is a server that translates domain names (domain name) into their corresponding IP addresses (IP address), and vice versa. DNS stores a table of domain names (domain name) and their corresponding IP addresses (IP address) to resolve domain names in messages. A domain name is the name of a computer or group of computers on the Internet and is used to identify a computer’s electronic location—and sometimes its geographical location—during data transmission. A domain name consists of a series of names separated by dots. It usually includes an organization name and always includes a two- or three-letter suffix indicating the type of organization or the country or region in which the domain is located.
In general, the DC and DNS server are the same server.

Security Zone Segmentation

What Is a DMZ?

The full English name is “Demilitarized Zone,” meaning an “isolated zone.” In the security field, it specifically refers to “the area between the internal-network and external-network firewalls.”

It is commonly known as the demilitarized zone.

The most important point is the access-control arrangement:

The internal network can access the external network: Internal users need to access the Internet for work.
The internal network can access the DMZ: Administrators also need to manage their own websites and mail servers.
The external network cannot access the internal network.
The external network can access the DMZ: Servers in the DMZ need to provide services to the outside world.
The DMZ cannot access the internal network.
The DMZ cannot access the external network. This is not absolute, because some services also need external access, so it depends on the circumstances.

What Computers Are in a Domain?

Domain controllers: There are generally one or two DCs.

Member servers: Ordinary computers under the domain controller that do not have AD installed.

Clients: Office computers, such as computers used by operations and maintenance personnel.

Standalone servers: Servers that are on the same network but have not joined the domain environment.

Permission Classifications Within a Domain

Domain Local Group

Within a single domain, access can be assigned to users from multiple domains. In other words, resources in my domain are authorized to others, but the permissions can only be used locally; only I have the privileges.

Entire forest → me

Global Group

Domain Admins is the most powerful global group.

Users from a single domain can access resources in multiple domains, but they must be users from the same domain. I am the domain administrator.

My domain → entire forest

Universal Group

Members of a universal group can be users from any domain in the domain forest.

These accounts are highly suitable for cross-domain access within a domain forest.

Entire forest → entire forest

The A-G-DL-P Strategy

A commonly used strategy format:

A (Account) represents a user account.
G (Global Group) represents a global group.
U (Universal Group) represents a universal group.
DL (Domain Local Group) represents a domain local group.
P (Permission) represents resource permissions.
Organizing and managing users according to the A-G-DL-P strategy makes administration easier.
The A-G-DL-P strategy means adding user accounts to global groups, adding global groups to domain local groups, and then assigning resource permissions to the domain
local groups.

Permissions of Common Domain Local Groups

Members of the Administrators group have completely unrestricted access to computer/domain resources. It is probably the most powerful group.

Members of the Backup Operators group can perform backup and restore operations on domain controllers and can
log on locally to and shut down domain controllers.

Members of the Remote Desktop Users group are granted remote logon permissions.

By default, members of the Domain Admins group have full administrative privileges on all domain-joined servers and workstations, domain controllers, and Active
Directory. This is what we commonly call a domain administrator.

The Enterprise Admins group is a group in the root domain of the domain forest. This group is a member of the Administrators group in every
domain within the forest and therefore has full access to all domain controllers.

Members of the Print Operators group can manage network printers.

Members of the Account Operators group can create and manage users and groups in the domain and can configure
their permissions.

The Domain Users group contains all domain members.