Abuse ACL
Abuse Access Control List (ACL), attacks on paths shown by bloodhound.
Last updated
Abuse Access Control List (ACL), attacks on paths shown by bloodhound.
Last updated
The WriteOwner permission is a special ACE that lets a user change the ownership of an object. If the WriteOwner permission granted on an object, we can change the owner of that object to ourselves or another account we control. Once compromised, we gain full control over the object, allowing us to: Modify permissions to grant ourselves additional privileges. Change sensitive properties like resetting the account's password. In an attack scenario, an attacker with WriteOwner on a user account (such as a privileged account) can take ownership of that account, reset its password, and effectively take over the account to escalate privileges.
With impacket-owneredit
Or with bloodyAD
Now, to abuse ownership of a group object, we can modifying the rights with impacket-dacledit. Give user WriteMembers permissions (allows user to add or remove members in the target group)
This step effectively allows us to be granted with any privileges or access rights associated with the target group.
Finally, you can add members to the group
and verify that the user was successfully added to the group
Generic Write access grants you the ability to write to any non-protected attribute on the target object, including "members" for a group, and "serviceprincipalnames" for a user.
With Certipy
By abusing GenericWrite permissions, we added with pyWhisker a certificate to the target account as an alternative authentication method.
This certificate can then be used with gettgtpkinit to request a Kerberos TGT as target, giving control over that account.
Synchronize time with domain controller with ntpdate or rdate.
Get hash of tgt with getnthash
Allows us to modify properties and have control of a user. We can reset the password of the user without knowing their current one.
Or with bloodyAD (PtH)
With GenericAll, GenericWrite, WriteProperty or Validated-SPN.
