Package: bta
About BTABTA is an open-source Active Directory security audit framework. Its goal is to help
auditors harvest the information they need to answer such questions as:Who has rights over a given object (computer, user account, etc.) ?Who can read a given mailbox ?Which are the accounts with domain admin rights ?Who has extended rights (userForceChangePassword,SendAs, etc.) ?What are the changes done on an AD between two points in time ?The framework is made ofan importer able to translate antds.ditfile, containing all the AD data, into a databasetools to query the databaseAD miner frameworkAD diff utilitysmall utilities (list of databases, etc.)The comprehensive set of attributes are imported and can be querried
including all schema extensions (Exchange, Sharepoint, etc.).Each question can be crystallized by an AD expert as a miner, so that
it can be used during all audits without doing the hard work again.Installing BTAQuick installDependencies:mongodb (apt-getinstallmongodb-server)libesedb 2012 alpha version[1]https://bitbucket.org/iwseclabs/bta/downloads/libesedb-alpha-20120102.tar.gzSHA-12aba34b1c9703a28b8913019044efa3ff53428fbBuild it. Install it or haveLD_LIBRARY_PATHpoint to it when usingbtaimportInstallation:pip install btaFrom sourcesDependencies:mongodb (apt-getinstallmongodb-serverpython-pymongo)libesedb 2012 alpha version[1]https://bitbucket.org/iwseclabs/bta/downloads/libesedb-alpha-20120102.tar.gzSHA-12aba34b1c9703a28b8913019044efa3ff53428fbBuild it. Install it or haveLD_LIBRARY_PATHpoint to it when usingbtaimportopenpyxl (>= 2.0.2)Installation:python setup.py install[1](1,2)support for so called long values is a work in progress in the latest versions and is not working well yet. It is working correctly with 2012 alpha version.Active Directory Security AnalysisGoal:Clean an AD or an AD forest, looking forbad practicesforgotten entriesbackdoorsrecompromissionsBTA is an operationnal tool, ought to bedeterministic, reliablerunning a well established procedureProtocolAudit steps:Extract  thentds.ditfileImport thentds.ditfile in a databaseLook for control points in the databaseExtractionHere is a way to backup NTDS.dit file for a domain controller which is running on Windows 2008.
See[2]for more information or for Windows 2003 method.ntdsutil
activate instance ntds
ifm
create full c:{\bs}NTDS_saved
quit
quit[2]https://www.sstic.org/2012/presentation/audit_ace_active_directory/Importingntds.ditis unusable as-is.onentds.ditis imported into one MongoDBdatabaseability to import severalntds.ditin parallelExamples:ntds2db -C ::mydb /path/to/ntds.dit
ntds2db /path/to/*.dit  --multi             \
  --C-from-filename                         \
     "::%s" "basename rmext 'DB' swap plus"AnalysingQuerying the databaseanalysing control points of a database:btamineranalysing differences between 2 bases:btadiffAnalysing control pointsminers crystallize expertiselist of admin accountslist of accounts with extended rightslist of accounts with password errorslist of various timelinesbtaminer -t ReST -C ::AD1 Schema --timelineCS created

Analysis by miner [Schema]
==========================

+---------------+-----------------------+
| Date          | Affected class schema |
+===============+=======================+
| 2009-02-11 18 | 234                   |
| 2011-12-20 00 | 267                   |
| 2011-12-22 14 | 3                     |
| 2011-12-23 18 | 46                    |
+---------------+-----------------------+Analysing differencesdiffdiff (naive for the moment) between 2 imports at different points in timenoise filtering$ btadiff --CA ::ADclean --CB ::ADbackdoor --ignore-defaults
===============
Starting diffing sd_table
---------------
AB,101: [] *sd_refcount['14'=>'15']
AB,108: [] *sd_refcount['39'=>'41']
A ,229: []
A ,372: []
AB,423: [] *sd_refcount['3'=>'2']
 B,424: []
 B,425: []
 B,428: []
---------------
Table [sd_table]: 160 records checked, 2 disappeared, 3 appeared, 3 changed
===============
[...]===============
Starting diffing datatable
---------------
AB,3586: [DC001] *logonCount['116'=>'117'], *lastLogon['130052518207794051L'=>'130052535716737649L']
AB,3639: [RID Set] *rIDNextRID['1153'=>'1154']
AB,8784: [A:[gc]/B:[gc  DEL:346bf199-8567-4375-ac15-79ec4b42b270]] +isDeleted,
         *name["u'gc'"=>"u'gc\\nDEL:346bf199-8"], *dc["u'gc'"=>"u'gc\\nDEL:346bf199-8"]
AB,8785: [A:[DomainDnsZones]/B:[DomainDnsZones  DEL:58b2962b-708c-4c93-99ff-0b7e163131f9]]
         +isDeleted, *name["u'DomainDnsZones'"=>"u'DomainDnsZones\\nDE"],
         *dc["u'DomainDnsZones'"=>"u'DomainDnsZones\\nDE"]
AB,8786: [A:[ForestDnsZones]/B:[ForestDnsZones  DEL:87f7d8a2-4d05-48d0-8283-9ab084584470]]
         +isDeleted, *name["u'ForestDnsZones'"=>"u'ForestDnsZones\\nDE"],
         *dc["u'ForestDnsZones'"=>"u'ForestDnsZones\\nDE"]
 B,8789: [snorky insomnihack]
 B,8790: [gc]
 B,8791: [DomainDnsZones]
 B,8792: [ForestDnsZones]
---------------
Table [datatable]: 7636 records checked, 0 disappeared, 4 appeared, 5 changed
===============Other featurescan give reports in different formats:live dumpReST documentzipped tree of CSV filesaudit log of writings in a databasetable consistency checks beforeminingAuthorsAirbus Group CERTAirbus Group InnovationsAirbus DS CyberSecurity