ADACL-002: GenericAll Permissions on Critical Objects
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check reads the nTSecurityDescriptor attribute of a curated set of high-value AD objects: the domain root (domainDNS), the Domain Controllers OU, the AdminSDHolder container in CN=System, each Domain Controller computer object, members of Domain Admins, Enterprise Admins, Schema Admins, Account Operators, Backup Operators, Server Operators, and Print Operators, plus the krbtgt account and any object protected by the SDProp process (adminCount=1). For each ACE in the discretionary ACL, Guerrilla decodes the ActiveDirectoryRights flag and tests whether GenericAll (0xF01FF) is granted. Trustees are then compared against an allowlist of default principals (BUILTIN\Administrators, NT AUTHORITY\SYSTEM, Enterprise Admins, Domain Admins, the relevant SDProp owner, the object's SELF SID where appropriate). Any ACE that grants GenericAll to a principal outside that allowlist is recorded as a finding.
Por qué importa
GenericAll is the strongest object-level right in AD. A trustee with GenericAll on a user object can reset the password without knowing the old one, then authenticate as that user. On a group, GenericAll lets the trustee add themselves (or any other principal) as a member, instantly inheriting all delegated rights. On a computer object, GenericAll enables Resource-Based Constrained Delegation (RBCD) abuse: an attacker writes msDS-AllowedToActOnBehalfOfOtherIdentity to a computer they control, then uses S4U2Self/S4U2Proxy to impersonate any user, including Domain Admins, against that host. On the domain root, GenericAll grants DS-Replication-Get-Changes-All (via DACL rewrite), enabling DCSync. The blast radius of a single misplaced GenericAll on a Tier 0 object is the entire forest: full credential extraction, golden ticket forgery, and persistent backdoors via AdminSDHolder.
Ruta de ataque
Step 1: Enumerate ACLs. The operator runs BloodHound (SharpHound or AzureHound for hybrid) and queries for the GenericAll edge from any owned principal to a Tier 0 target. Equivalent PowerShell: Get-Acl "AD:CN=Domain Admins,CN=Users,DC=corp,DC=local" or PowerView Get-ObjectAcl -ResolveGUIDs. Step 2: Pick the cheapest abuse path for the target type. - User target: Set-DomainUserPassword -Identity victim -AccountPassword $cred (PowerView) or net user victim NewPass! /domain. Then authenticate as the victim. - Group target: Add-DomainGroupMember -Identity "Domain Admins" -Members attacker. Logoff/logon and the new SID lands in the token. - Computer target: Set msDS-AllowedToActOnBehalfOfOtherIdentity to a SID the attacker controls (typically a freshly created machine account via MachineAccountQuota), then Rubeus s4u to mint a TGS as Administrator. Pass-the-ticket and access SYSTEM on the target host. - Domain root: Rewrite the DACL to grant the attacker DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, then run secretsdump or Mimikatz lsadump::dcsync to extract krbtgt and every NTLM hash. Step 3: Persist. Add GenericAll back via AdminSDHolder to restore the path after defenders revoke it. SDProp will re-stamp the ACE onto every protected object within 60 minutes.
Cómo lo evalúa Guerrilla
Guerrilla queries the security descriptor of each target object via the directory services API (System.DirectoryServices.ActiveDirectorySecurity) so SACL access is not required. For each access control entry, ActiveDirectoryRights is bitwise-tested against GenericAll. The IdentityReference is resolved to a SID and compared against the built-in privileged baseline. Findings include the target distinguishedName, the trustee SID, the trustee resolved name, the ACE type (Allow/Deny), inheritance flags, and whether the ACE is inherited or explicit. Guerrilla also cross-references the trustee against ADACL-001 (owner anomalies) and ADACL-004 (WriteDACL) to flag chained ACL abuse paths. For continuous monitoring, the check recommends enabling Directory Service Changes auditing on the relevant OUs (subcategory: DS Access > Audit Directory Service Changes) so Event ID 5136 fires on every nTSecurityDescriptor modification.
Valor recomendado
No non-default principals with GenericAll on critical AD objects
Remediación
Enumerate ACLs on critical objects using PowerShell or BloodHound. Remove GenericAll ACEs for any principal that does not require full control. Replace with least-privilege delegated permissions where operational needs exist. Monitor for ACL changes using Directory Service Changes auditing (Event ID 5136).
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3
- ANSSI
- vuln_permissions_genericall
- MITRE ATT&CK
- T1222.001, T1098