Skip to content

Commit 8acd6ee

Browse files
MichaelGrafnetterMichaelGrafnetter
authored
Merge Draft 0.9
1 parent 58af3bb commit 8acd6ee

26 files changed

+2151
-409
lines changed

‎.gitattributes‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Force LF line endings on shell scripts, even in Windows.
2+
*.sh text eol=lf

‎.github/workflows/deploy-pages.yml‎

Lines changed: 37 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,12 @@ name: Deploy GitHub Pages
33
on:
44
push:
55
branches: ["main"]
6-
7-
workflow_dispatch:
6+
paths:
7+
- README.md
8+
- ADDS/README.md
9+
- ADDS/GPOReport.html
10+
- Generators/mkdocs/*
11+
- .github/workflows/deploy-pages.yml
812

913
permissions:
1014
contents: read
@@ -16,21 +20,46 @@ concurrency:
1620
cancel-in-progress: false
1721

1822
jobs:
19-
deploy:
20-
name: Deploy
21-
environment:
22-
name: github-pages
23-
url: ${{ steps.deployment.outputs.page_url }}
23+
build:
24+
name: MKDocs Build
2425
runs-on: ubuntu-latest
2526
steps:
2627
- name: Checkout
2728
uses: actions/checkout@v4
29+
2830
- name: Setup Pages
31+
id: setup
2932
uses: actions/configure-pages@v5
33+
34+
- name: Setup Python
35+
uses: actions/setup-python@v5
36+
with:
37+
python-version: 3.x
38+
cache: pip
39+
cache-dependency-path: Generators/mkdocs/requirements.txt
40+
41+
- name: Install MKDocs
42+
run: pip install mkdocs
43+
44+
- name: Build site with MKDocs
45+
run: Generators/mkdocs/mkdocs.sh
46+
env:
47+
REPO_URL: ${{ github.server_url }}/${{ github.repository }}/blob/${{ github.ref_name }}
48+
SITE_URL: ${{ steps.setup.outputs.base_url }}
49+
3050
- name: Upload artifact
3151
uses: actions/upload-pages-artifact@v3
3252
with:
33-
path: ADDS/GPOReport.html
53+
path: site
54+
55+
deploy:
56+
name: GitHub Pages Deployment
57+
environment:
58+
name: github-pages
59+
url: ${{ steps.deployment.outputs.page_url }}
60+
runs-on: ubuntu-latest
61+
needs: build
62+
steps:
3463
- name: Deploy to GitHub Pages
3564
id: deployment
3665
uses: actions/deploy-pages@v4

‎.github/workflows/generate-whitepaper.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
run: echo "date=$(date '+%B %e, %Y')" > $GITHUB_OUTPUT
2121

2222
- name: Generate the whitepaper using Pandoc
23-
uses: docker://pandoc/extra
23+
uses: docker://pandoc/extra:3.1.1
2424
with:
2525
args: >-
2626
--output=Domain_Controller_Firewall.pdf
@@ -33,7 +33,7 @@ jobs:
3333
--toc-depth=2
3434
--number-sections
3535
--template=eisvogel
36-
--lua-filter=pandoc.lua
36+
--lua-filter=Generators/pandoc/pandoc.lua
3737
--variable=lof:true
3838
--variable=classoption:oneside
3939
--variable=geometry:a4paper,margin=2cm

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,7 @@
1+
# Documents generated by Pandoc
12
*.pdf
23
*.docx
4+
5+
# Website generated by MkDocs
6+
/docs/
7+
/site/

‎ADCS/StaticPorts.bat‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
@ECHO OFF
2+
3+
REM Author: Michael Grafnetter
4+
5+
REM Reconfigure the CA to use port 10509/TCP for RPC traffic
6+
REM instead of a random port from the 49152-65535 dynamic range.
7+
reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{D99E6E74-FC88-11D0-B498-00A0C90312F3}" /v Endpoints /d "ncacn_ip_tcp,0,10509" /t REG_MULTI_SZ /f
8+
9+
REM Restart the service for the changes to apply
10+
net.exe stop CertSvc
11+
net.exe start CertSvc
12+
13+
REM Required CA ports are now:
14+
REM 135/TCP - RPC Endpoint Mapper
15+
REM 10509/TCP - Certificate Request RPC API
16+
REM 80/TCP - HTTP CRL + OCSP
17+
REM 443/TCP - HTTPS CA Web Enrolment
18+
19+
REM Press any key...
20+
pause

‎ADDS/DCFWTool/CustomRules.Sample.ps1‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<#
2+
.SYNOPSIS
3+
Adds custom firewall rules to a pre-existing GPO session.
4+
5+
.DESCRIPTION
6+
This script is not intended to be run directly. Instead, its relative path should be specified in the Set-ADDSFirewallPolicy.json configuration file.
7+
It is then executed by the main Set-ADDSFirewallPolicy.ps1 script.
8+
9+
.PARAMETER GPOSession
10+
Specifies the network GPO session in which the rules are to be created. To load a GPO Session, use the Open-NetGPO cmdlet. To save a GPO Session, use the Save-NetGPO cmdlet.
11+
12+
.PARAMETER DomainControllerAddresses
13+
List of domain controller IP addresses, between which replication traffic should be allowed.
14+
15+
.PARAMETER RemoteManagementAddresses
16+
List of IP addresses from which inbound management traffic should be allowed. This list may optionally include the IP addresses of the domain controllers.
17+
18+
.PARAMETER AllAddresses
19+
List of client IP adresses from which inbound traffic should be allowed. This list should include the IP addresses of the domain controllers and management systems.
20+
21+
.NOTES
22+
Author: Michael Grafnetter
23+
Version: 2.5
24+
25+
#>
26+
27+
#Requires -Modules NetSecurity
28+
#Requires -Version 5
29+
30+
[CmdletBinding()]
31+
param(
32+
[Parameter(Mandatory = $true)]
33+
[string] $GPOSession,
34+
35+
[ValidateNotNullOrEmpty()]
36+
[string[]] $ClientAddresses = @('Any'),
37+
38+
[ValidateNotNullOrEmpty()]
39+
[string[]] $ManagementAddresses = @('Any'),
40+
41+
[ValidateNotNullOrEmpty()]
42+
[string[]] $DomainControllerAddresses = @('Any'),
43+
44+
[ValidateNotNullOrEmpty()]
45+
[string[]] $RemoteManagementAddresses = @('Any'),
46+
47+
[ValidateNotNullOrEmpty()]
48+
[string[]] $AllAddresses = @('Any')
49+
)
50+
51+
# Not all cmdlets inherit the -Verbose parameter, so we need to explicitly override it.
52+
[bool] $isVerbose = $VerbosePreference -eq [System.Management.Automation.ActionPreference]::Continue
53+
54+
#region Custom Rules
55+
56+
<#
57+
Feel free to add your custom firewall rules below to match your environment.
58+
#>
59+
60+
# Create Inbound rule "File and Printer Sharing over SMBDirect (iWARP-In)"
61+
New-NetFirewallRule -GPOSession $gpoSession `
62+
-Name 'FPSSMBD-iWARP-In-TCP' `
63+
-DisplayName 'File and Printer Sharing over SMBDirect (iWARP-In)' `
64+
-Group 'File and Printer Sharing over SMBDirect' `
65+
-Description 'Inbound rule for File and Printer Sharing over SMBDirect to allow iWARP [TCP 5445]' `
66+
-Enabled False `
67+
-Profile Any `
68+
-Direction Inbound `
69+
-Action Allow `
70+
-Protocol TCP `
71+
-LocalPort 5445 `
72+
-RemoteAddress $AllAddresses `
73+
-Program 'System' `
74+
-Verbose:$isVerbose > $null
75+
76+
#endregion Custom Rules

‎ADDS/DCFWTool/PolicyDefinitions/DomainControllerFirewall.admx‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<!-- (c) 2024 Michael Grafnetter -->
33
<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.1" schemaVersion="1.0"
55
xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xsi:schemaLocation="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions ../../ADMXSchema/PolicyDefinitionFiles.xsd">
66
<policyNamespaces>
77
<target prefix="dsinternals" namespace="DSInternals.Policies.Firewall" />
88
<using prefix="windows" namespace="Microsoft.Policies.Windows" />
99
<using prefix="dnsclient" namespace="Microsoft.Policies.DNSClient" />
1010
</policyNamespaces>
11-
<resources minRequiredRevision="1.0" />
11+
<resources minRequiredRevision="1.1" />
1212
<categories>
1313
<category name="RPCStaticPorts" displayName="$(string.RPCStaticPorts)" />
1414
</categories>
@@ -55,6 +55,20 @@
5555
<decimal id="RPCStaticPorts_NTFRS_Value" valueName="RPC TCP/IP Port Assignment" required="true" minValue="1024" maxValue="49151" />
5656
</elements>
5757
</policy>
58+
<policy name="RPCStaticPorts_CertSvc" class="Machine" displayName="$(string.RPCStaticPorts_CertSvc)" explainText="$(string.RPCStaticPorts_CertSvc_Help)" key="SOFTWARE\Classes\AppID\{D99E6E74-FC88-11D0-B498-00A0C90312F3}" presentation="$(presentation.RPCStaticPorts_CertSvc)">
59+
<parentCategory ref="RPCStaticPorts" />
60+
<supportedOn ref="windows:SUPPORTED_Win2k" />
61+
<disabledList>
62+
<item key="SOFTWARE\Classes\AppID\{D99E6E74-FC88-11D0-B498-00A0C90312F3}" valueName="Endpoints">
63+
<value>
64+
<delete />
65+
</value>
66+
</item>
67+
</disabledList>
68+
<elements>
69+
<multiText id="RPCStaticPorts_CertSvc_Value" valueName="Endpoints" required="true" maxStrings="1" />
70+
</elements>
71+
</policy>
5872
<policy name="DNS_Turn_Off_MulticastDNS" class="Machine" displayName="$(string.DNS_Turn_Off_MulticastDNS)" explainText="$(string.DNS_Turn_Off_MulticastDNS_Help)" key="SYSTEM\CurrentControlSet\Services\DNSCache\Parameters" valueName="EnableMDNS">
5973
<parentCategory ref="dnsclient:DNS_Client" />
6074
<supportedOn ref="windows:SUPPORTED_Windows_10_0_RS1" />

‎ADDS/DCFWTool/PolicyDefinitions/en-US/DomainControllerFirewall.adml‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<!-- (c) 2024 Michael Grafnetter -->
33
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.1" schemaVersion="1.0"
55
xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" xsi:schemaLocation="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions ../../../ADMXSchema/PolicyDefinitionFiles.xsd">
66
<displayName>RPC Static Ports</displayName>
77
<description>Remote Procedure Call Static Port Number Settings</description>
@@ -15,23 +15,31 @@ If you enable this policy setting and specify a static port number, Active Direc
1515

1616
If you disable or do not configure this policy setting, Active Directory RPC will use a dynamic port for communication.
1717

18-
Note that the NTDS service must be restarted for the new setting to become effective.</string>
18+
Note that the Active Directory Domain Services (NTDS) must be restarted for the new setting to become effective.</string>
1919
<string id="RPCStaticPorts_NETLOGON">Domain Controller: Netlogon static port</string>
2020
<string id="RPCStaticPorts_NETLOGON_Help">This policy setting allows you to configure a static port number for the Netlogon service on a domain controller.
2121

2222
If you enable this policy setting and specify a static port number, the Netlogon service will use that port for communication.
2323

2424
If you disable or do not configure this policy setting, the Netlogon service will use a dynamic port for communication.
2525

26-
Note that the NTDS service must be restarted for the new setting to become effective.</string>
26+
Note that the Active Directory Domain Services (NTDS) must be restarted for the new setting to become effective.</string>
2727
<string id="RPCStaticPorts_NTFRS">Domain Controller: File Replication Service (FRS) static port</string>
2828
<string id="RPCStaticPorts_NTFRS_Help">This policy setting allows you to configure a static port number for the File Replication Service (FRS) on a domain controller.
2929

3030
If you enable this policy setting and specify a static port number, the FRS will use that port for communication.
3131

3232
If you disable or do not configure this policy setting, the FRS will use a dynamic port for communication.
3333

34-
Note that the File Replication Service must be restarted for the new setting to become effective.</string>
34+
Note that the File Replication (NtFrs) service must be restarted for the new setting to become effective.</string>
35+
<string id="RPCStaticPorts_CertSvc">Certification Authority: Certificate request RPC static port</string>
36+
<string id="RPCStaticPorts_CertSvc_Help">This policy setting allows you to configure a static port number used by Active Directory Certificate Services to accept certificate requests.
37+
38+
If you enable this policy setting and specify a static RPC over TCP endpoint, the CA will use it for communication. The required format of the endpoint is "ncacn_ip_tcp,0,PortNumber". The port number is recommended to be between 1024 and 49151, e.g., "ncacn_ip_tcp,0,10509".
39+
40+
If you disable or do not configure this policy setting, the CA will use a dynamic port for RPC communication.
41+
42+
Note that the Active Directory Certificate Services (certSvc) must be restarted for the new setting to become effective.</string>
3543
<string id="DNS_Turn_Off_MulticastDNS">Turn off Multicast DNS (mDNS) client</string>
3644
<string id="DNS_Turn_Off_MulticastDNS_Help">This policy setting allows you to turn off the Multicast DNS (mDNS) client.
3745

@@ -49,6 +57,9 @@ If you disable or do not configure this policy setting, the Multicast DNS (mDNS)
4957
<presentation id="RPCStaticPorts_NTFRS">
5058
<decimalTextBox refId="RPCStaticPorts_NTFRS_Value" defaultValue="38903">Static port number:</decimalTextBox>
5159
</presentation>
60+
<presentation id="RPCStaticPorts_CertSvc">
61+
<multiTextBox refId="RPCStaticPorts_CertSvc_Value" defaultHeight="1">Static RPC endpoint:</multiTextBox>
62+
</presentation>
5263
</presentationTable>
5364
</resources>
5465
</policyDefinitionResources>

‎ADDS/DCFWTool/RpcNamedPipesFilters.txt‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Synopsis: This NETSH script is part of the Domain Controller Firewall project.
22
# Author: Michael Grafnetter
3-
# Version: 1.0
3+
# Version: 2.0
44
# Usage: netsh.exe -f RpcNamedPipesFilters.txt
55
# Rollback: netsh.exe rpc filter delete filter filterkey=all
66
# Check: netsh.exe rpc filter show filter
@@ -96,9 +96,27 @@ add rule layer=um actiontype=block filterkey=0a239867-73db-45e6-b287-d006fe3c8b1
9696
add condition field=if_uuid matchtype=equal data=4FC742E0-4A10-11CF-8273-00AA004AE673
9797
add filter
9898

99+
# Restrict [MS-FSRVP]: File Server Remote VSS Protocol, Named pipe: \PIPE\FssagentRpc
100+
# Limit access to Domain Admins only.
101+
add rule layer=um actiontype=permit filterkey=869a3c6c-60dd-4558-a58b-8d9e86b0da5f
102+
add condition field=if_uuid matchtype=equal data=a8e0653c-2744-4389-a61d-7373df8b2292
103+
add condition field=remote_user_token matchtype=equal data=D:(A;;CC;;;DA)
104+
add filter
105+
106+
# Block MS-FSRVP by default
107+
add rule layer=um actiontype=block filterkey=4bce314a-d956-41cf-86f1-75067362cae6
108+
add condition field=if_uuid matchtype=equal data=a8e0653c-2744-4389-a61d-7373df8b2292
109+
add filter
110+
99111
# Block [MS-DNSP]: Domain Name Service (DNS) Server Management Protocol, Named pipe: \PIPE\DNSSERVER
100112
# This rule only blocks RPC over Named Pipes, while RPC over TCP is still allowed.
101113
add rule layer=um actiontype=block filterkey=50754fe4-aa2d-42ff-8196-e90ea8fd2527
102114
add condition field=protocol matchtype=equal data=ncacn_np
103115
add condition field=if_uuid matchtype=equal data=50abc2a4-574d-40b3-9d66-ee4fd5fba076
104116
add filter
117+
118+
# Block the MimiCom protocol used by Mimikatz
119+
rpc filter
120+
add rule layer=um actiontype=block filterkey=644291ca-9530-4066-b654-e7b838ebdc06
121+
add condition field=if_uuid matchtype=equal data=17FC11E9-C258-4B8D-8D07-2F4125156244
122+
add filter

‎ADDS/DCFWTool/Set-ADDSFirewallPolicy.Sample.json‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,15 @@
22
"$schema": "Set-ADDSFirewallPolicy.schema.json",
33
"GroupPolicyObjectName": "Domain Controller Firewall",
44
"GroupPolicyObjectComment": "This GPO is managed by the Set-ADDSFirewallPolicy.ps1 PowerShell script.",
5+
"TargetDomain": "contoso.com",
56
"LogDroppedPackets": true,
67
"LogAllowedPackets": false,
78
"LogFilePath": "%systemroot%\\system32\\logfiles\\firewall\\pfirewall.log",
89
"LogMaxSizeKilobytes": 128,
910
"ClientAddresses": [ "10.220.2.0/24", "10.220.4.0/24", "10.220.5.0/24", "10.220.6.0/24" ],
1011
"ManagementAddresses": [ "10.220.3.0/24" ],
1112
"DomainControllerAddresses": [ "10.220.1.0/24" ],
13+
"RadiusClientAddresses": [ "10.220.1.12/32", "10.220.1.13/32" ],
1214
"NtdsStaticPort": 38901,
1315
"NetlogonStaticPort": 38902,
1416
"FrsStaticPort": 38903,
@@ -17,6 +19,7 @@
1719
"DisableNetbiosBroadcasts": true,
1820
"DisableLLMNR": true,
1921
"DisableMDNS": true,
22+
"BlockManagementFromDomainControllers": false,
2023
"EnableServiceManagement": true,
2124
"EnableEventLogManagement": true,
2225
"EnableScheduledTaskManagement": true,
@@ -33,8 +36,17 @@
3336
"EnableNetbiosDatagramService": false,
3437
"EnableNetbiosSessionService": false,
3538
"EnableWINS": false,
39+
"EnableDhcpServer": false,
40+
"EnableNPS": false,
41+
"EnableKMS": false,
42+
"EnableWSUS": false,
43+
"EnableWDS": false,
44+
"EnableWebServer": false,
45+
"EnableFSRMManagement": false,
46+
"EnablePrintSpooler": false,
3647
"EnableNetworkProtection": true,
3748
"BlockWmiCommandExecution": true,
3849
"EnableRpcFilters": true,
39-
"EnableLocalIPsecRules": false
40-
}
50+
"EnableLocalIPsecRules": false,
51+
"CustomRuleFileNames": null
52+
}

0 commit comments

Comments
 (0)