ADACL-002: Permisos GenericAll en objetos críticos
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
GenericAll otorga control total sobre un objeto de AD, incluida la capacidad de modificar atributos, restablecer contraseñas, cambiar la pertenencia a grupos y modificar la DACL. Los principales no predeterminados con GenericAll sobre objetos críticos, como los Domain Admins, los controladores de dominio o la raíz del dominio, representan una vía directa al compromiso del dominio
Por qué importa
GenericAll is the strongest object-level right in AD. A trustee with GenericAll on a user object can reset the password without knowing the old one, then authenticate as that user. On a group, GenericAll lets the trustee add themselves (or any other principal) as a member, instantly inheriting all delegated rights. On a computer object, GenericAll enables Resource-Based Constrained Delegation (RBCD) abuse: an attacker writes msDS-AllowedToActOnBehalfOfOtherIdentity to a computer they control, then uses S4U2Self/S4U2Proxy to impersonate any user, including Domain Admins, against that host. On the domain root, GenericAll grants DS-Replication-Get-Changes-All (via DACL rewrite), enabling DCSync. The blast radius of a single misplaced GenericAll on a Tier 0 object is the entire forest: full credential extraction, golden ticket forgery, and persistent backdoors via AdminSDHolder.
Ruta de ataque
Step 1: Enumerate ACLs. The operator runs BloodHound (SharpHound or AzureHound for hybrid) and queries for the GenericAll edge from any owned principal to a Tier 0 target. Equivalent PowerShell: Get-Acl "AD:CN=Domain Admins,CN=Users,DC=corp,DC=local" or PowerView Get-ObjectAcl -ResolveGUIDs. Step 2: Pick the cheapest abuse path for the target type. - User target: Set-DomainUserPassword -Identity victim -AccountPassword $cred (PowerView) or net user victim NewPass! /domain. Then authenticate as the victim. - Group target: Add-DomainGroupMember -Identity "Domain Admins" -Members attacker. Logoff/logon and the new SID lands in the token. - Computer target: Set msDS-AllowedToActOnBehalfOfOtherIdentity to a SID the attacker controls (typically a freshly created machine account via MachineAccountQuota), then Rubeus s4u to mint a TGS as Administrator. Pass-the-ticket and access SYSTEM on the target host. - Domain root: Rewrite the DACL to grant the attacker DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, then run secretsdump or Mimikatz lsadump::dcsync to extract krbtgt and every NTLM hash. Step 3: Persist. Add GenericAll back via AdminSDHolder to restore the path after defenders revoke it. SDProp will re-stamp the ACE onto every protected object within 60 minutes.
Cómo lo evalúa Guerrilla
Guerrilla queries the security descriptor of each target object via the directory services API (System.DirectoryServices.ActiveDirectorySecurity) so SACL access is not required. For each access control entry, ActiveDirectoryRights is bitwise-tested against GenericAll. The IdentityReference is resolved to a SID and compared against the built-in privileged baseline. Findings include the target distinguishedName, the trustee SID, the trustee resolved name, the ACE type (Allow/Deny), inheritance flags, and whether the ACE is inherited or explicit. Guerrilla also cross-references the trustee against ADACL-001 (owner anomalies) and ADACL-004 (WriteDACL) to flag chained ACL abuse paths. For continuous monitoring, the check recommends enabling Directory Service Changes auditing on the relevant OUs (subcategory: DS Access > Audit Directory Service Changes) so Event ID 5136 fires on every nTSecurityDescriptor modification.
Valor recomendado
Ningún principal no predeterminado con GenericAll sobre objetos críticos de AD
Remediación
Enumere las ACL de los objetos críticos con PowerShell o BloodHound. Elimine las ACE de GenericAll para cualquier principal que no requiera control total. Sustitúyalas por permisos delegados de mínimo privilegio donde existan necesidades operativas. Supervise los cambios de ACL mediante la auditoría de cambios del servicio de directorio (Event ID 5136).
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3
- ANSSI
- vuln_permissions_genericall
- MITRE ATT&CK
- T1222.001, T1098