ADACL-003: GenericWrite Permissions on Critical Objects
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla enumerates the discretionary access control list (nTSecurityDescriptor) on user, computer, group, organizational unit, certificate template, and gPLink-linked container objects. For each ACE, the check evaluates ActiveDirectoryRights for the GenericWrite right (0x00020028) or a WriteProperty ACE with a NULL ObjectType GUID (which functions as GenericWrite). The trustee SID is then compared against a baseline of default principals (Domain Admins, Enterprise Admins, SYSTEM, Account Operators where applicable, the object owner, and built-in service accounts). Any ACE where the trustee is not in the default set is reported, with explicit prioritization of objects in privileged groups, krbtgt, AdminSDHolder, Domain Controllers, and accounts marked AdminCount=1.
Por qué importa
GenericWrite is one of the highest-impact ACL primitives in Active Directory because it grants write access to most writable attributes on the target. An attacker holding GenericWrite over a user can append a fake SPN and Kerberoast the account offline (targeted Kerberoasting), write a controlled certificate to msDS-KeyCredentialLink to mint a Kerberos PKINIT TGT for the victim (Shadow Credentials), or, against a computer object, populate msDS-AllowedToActOnBehalfOfOtherIdentity with an attacker-controlled SPN to perform Resource-Based Constrained Delegation impersonation up to and including the local SYSTEM context. Over an OU, GenericWrite allows modification of gPLink to attach a malicious GPO to every child user and computer. Because these primitives are silent (no group membership change, no password reset), GenericWrite ACEs are a favored DACL backdoor for persistence, as documented in SpecterOps "An ACE Up the Sleeve".
Ruta de ataque
Step 1: Enumerate ACLs. The attacker collects DACLs with SharpHound, BloodHound CE, PowerView Get-DomainObjectAcl, or ldapsearch and identifies controlled principals with GenericWrite over Tier 0 objects. Step 2a (Targeted Kerberoasting): Write a fake SPN to the victim user (Set-ADUser -ServicePrincipalNames @{Add="fake/svc"}), request a TGS with Rubeus kerberoast or GetUserSPNs.py, then crack offline with hashcat mode 13100. Step 2b (Shadow Credentials): Run Whisker add or Certipy shadow auto against the victim to write a Key Credential to msDS-KeyCredentialLink, then authenticate with PKINIT to recover the NT hash via UnPAC-the-Hash. Step 2c (RBCD on a computer object): Create or control a computer account (default ms-DS-MachineAccountQuota allows this), use Rubeus s4u or Impacket rbcd.py to write msDS-AllowedToActOnBehalfOfOtherIdentity on the victim computer, then S4U2Self and S4U2Proxy to obtain a TGS as Domain Admin against the victim host. Step 2d (OU gPLink): Link a SYSVOL-hosted malicious GPO to the OU by writing gPLink; on next refresh, the GPO executes a scheduled task or immediate task on every child object. Step 3: Use harvested credentials or impersonation to pivot to Domain Controller compromise.
Cómo lo evalúa Guerrilla
Guerrilla binds to the target domain via System.DirectoryServices and reads nTSecurityDescriptor for each object in scope. It parses the DACL with ActiveDirectorySecurity.GetAccessRules, filters for AccessControlType.Allow ACEs whose ActiveDirectoryRights includes GenericWrite, then resolves the IdentityReference to a SID. SIDs are cross-referenced against a default-principals allowlist scoped to the object class (for example, Account Operators is default on user objects but not on Tier 0). For each remaining ACE, the check records the object DN, trustee SID and name, inheritance flags, and whether the trustee is a security-enabled group, computer, or user. The check correlates findings against AdminSDHolder protection and the Protected Users group to highlight ACEs over Tier 0 identities first.
Valor recomendado
No non-default principals with GenericWrite on critical AD objects
Remediación
Audit ACLs on user, computer, and group objects for GenericWrite permissions. Remove unnecessary GenericWrite ACEs and replace with specific attribute-level write permissions. Pay special attention to write access on msDS-AllowedToActOnBehalfOfOtherIdentity, servicePrincipalName, and msDS-KeyCredentialLink attributes.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3
- ANSSI
- vuln_permissions_genericwrite
- MITRE ATT&CK
- T1222.001, T1098