trimarcjake / bluetuxedo

A tiny tool to find and fix common misconfigurations in Active Directory-integrated DNS

BlueTuxedo

A tiny tool built to find and fix common misconfigurations in Active Directory-Integrated DNS (and a little DHCP as a treat).

How can BlueTuxedo help you?

Read the slides from WWHF.

Watch the presentation from BSidesCharm.

Quick Start:

# Install from PSGallery
Install-Module -Name BlueTuxedo -Scope CurrentUser
Invoke-BlueTuxedo

# Clone from GitHub and Import
git clone https://github.com/TrimarcJake/BlueTuxedo.git
cd BlueTuxedo
Import-Module .\BlueTuxedo.psd1 -Force
Invoke-BlueTuxedo

# Use the testing branch - probably broken, but 🤷‍♀️
git clone https://github.com/TrimarcJake/BlueTuxedo.git
cd BlueTuxedo
git checkout testing
Import-Module .\BlueTuxedo.psd1 -Force
Invoke-BlueTuxedo

Running Invoke-BlueTuxedo with no paramters will Get stuff, Test it, then offer code for how to Repair identified issues (where possible).

Get Stuff

• ADI Zones
• Conditional Forwarder
• Dangling SPNs ¹
• DHCP Dynamic Update service account configuration
• DnsAdmins Membership
• DnsUpdateProxy Membership
• Forwarder Configuration
• Global Query Block List (GQBL)
• Non-ADI Zone Auditing
• Query Resolution Policies
• Security Descriptors
• Socket Pool Configuration
• Tombstoned DNS Records
• Wildcard Record
• WPAD Record
• Zone Scopes
• Zone Scope Containers

Test Stuff

Item	Test Condition
ADI Zones	Is Legacy Zone?
ADI Zones	Are Secure Updates enabled?
DHCP Dynamic Update service account	Exists on each DHCP server?
Dangling SPNs	Exist?
DnsAdmins Membership	Is non-zero?
DnsUpdateProxy Membership	Is non-zero?
Forwarder Configuration	Exist?
Global Query Block List (GQBL)	Contains wpad/isatap
Non-ADI Zones	Exist?
Query Resolution Policies	Exist?
Security Descriptor (ACEs)	Standard/Expected?
Security Descriptor (Ownership)	Standard/Expected?
Socket Pool Configuration	Is maximum?
Tombstoned DNS Records	Exist?
Wildcard Record	Exists & correct type?
WPAD Record	Exists & correct type?
Zone Scopes	Exist?
Zone Scope Containers	Exists & empty?

Repair Stuff

Item	Fix
ADI Zones	Convert Legacy (Windows 2000 Compatible) Zones to Modern
Dangling SPNs	Delete SPN from Account
Socket Pool Configuration	Set Socket Pool Configuration to Maximum
Tombstoned DNS Records	Delete Tombstoned DNS Record
Wildcard Record	Create Proper Wildcard Record
WPAD Record	Create Proper WPAD Record

Footnotes

1. A "Dangling SPN" is a Service Principal Name (SPN) in which the host portion of the SPN does not resolve to an IP address. ↩

bluetuxedo's Issues

no

Update Show- functions.

Show- functions were using variables from the script scope, so they don't work standalone.

Need to pass variables to them.

Add Logic to Repair-BTADIZone to Select Domain- or Forest-replicated Destination Zone

There should be an option to select which type of new zone will be created.

File-backed zones are likely a configuration and security nightmare and should not be an option.

Domain-replicated is probably fine, but default should be Forest-replicated.

Run script automated and output to file?

Howdy!
Is there a way to run the script without hitting enter to the various questions (accepting the defaults), as well as have it output it all to a file to review afterwards?

Look for Zones with identical names in different Partitions

See: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/am-i-seeing-double-the-case-of-quot-multiple-copies-of-the-same/ba-p/255499

Problem with 'DhcpServer' module

This could very well be something I am doing wrong, but when I try to import the module, I get this error:

PS C:\powershell\bluetux\BlueTuxedo-main> import-module .\BlueTuxedo.psd1
import-module : The required module 'DhcpServer' is not loaded. Load the module or remove the module from
'RequiredModules' in the file 'C:\powershell\bluetux\BlueTuxedo-main\BlueTuxedo.psd1'.
At line:1 char:1
+ import-module .\BlueTuxedo.psd1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (C:\powershell\b...BlueTuxedo.psd1:String) [Import-Module], Missing
   MemberException
    + FullyQualifiedErrorId : Modules_InvalidManifest,Microsoft.PowerShell.Commands.ImportModuleCommand

Let me know if there is something I can try to resolve this, or if you have questions. Thanks! Great talk at WWHF by the way.

Create Repair- function for Dangling SPNs

Dangling SPNs should be removed from the principals they are attached to. BlueTuxedo should provide code for removing SPNs.

Look for GlobalNames zone

Allows for single-name domains. Dangerous af.

See: https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc137727(v=msdn.10)

Specify domain

Howdy,
How would I specify a particular domain to use? I am testing out in a scenario that has a few domain trusts (including one that is down), and it is taking very long to error out on these remote domains.
Thanks!

Failed to Enumerate Zones

Hello, while executing BlueTuxedo on a custom Windows 10 image that was not domain joined, my team received the following errors at on a client engagement:

We executed it within a runas /netonly shell using a compromised standard user and confirmed the shell to be valid. The client is in fact using ADIDNS through conversation with them. We have disabled Windows Defender locally and have not been having client IPSs blocking on our loud activities (i.e., BloodHound). Client hostnames are resolving and we can authenticate to DCs without issue.

If you have any ideas, feel free to reach out sooner rather later as I will only be on this client network as the engagement will end soon. Certainly understand any delays of course.

Create Repair- function for Legacy Zones.

Legacy zones should be converted to domain- or forest-replicated zone. BlueTuxedo should provide code for converting these zones to more modern types.