ADACL-003: Permisos GenericWrite en objetos críticos
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
GenericWrite permite modificar la mayoría de los atributos de un objeto, lo que habilita ataques como Kerberoasting dirigido (escribiendo un SPN), delegación restringida basada en recursos (escribiendo msDS-AllowedToActOnBehalfOfOtherIdentity) o Shadow Credentials (escribiendo msDS-KeyCredentialLink). Los principales no predeterminados con GenericWrite sobre objetos críticos deben investigarse
Por qué importa
GenericWrite is one of the highest-impact ACL primitives in Active Directory because it grants write access to most writable attributes on the target. An attacker holding GenericWrite over a user can append a fake SPN and Kerberoast the account offline (targeted Kerberoasting), write a controlled certificate to msDS-KeyCredentialLink to mint a Kerberos PKINIT TGT for the victim (Shadow Credentials), or, against a computer object, populate msDS-AllowedToActOnBehalfOfOtherIdentity with an attacker-controlled SPN to perform Resource-Based Constrained Delegation impersonation up to and including the local SYSTEM context. Over an OU, GenericWrite allows modification of gPLink to attach a malicious GPO to every child user and computer. Because these primitives are silent (no group membership change, no password reset), GenericWrite ACEs are a favored DACL backdoor for persistence, as documented in SpecterOps "An ACE Up the Sleeve".
Ruta de ataque
Step 1: Enumerate ACLs. The attacker collects DACLs with SharpHound, BloodHound CE, PowerView Get-DomainObjectAcl, or ldapsearch and identifies controlled principals with GenericWrite over Tier 0 objects. Step 2a (Targeted Kerberoasting): Write a fake SPN to the victim user (Set-ADUser -ServicePrincipalNames @{Add="fake/svc"}), request a TGS with Rubeus kerberoast or GetUserSPNs.py, then crack offline with hashcat mode 13100. Step 2b (Shadow Credentials): Run Whisker add or Certipy shadow auto against the victim to write a Key Credential to msDS-KeyCredentialLink, then authenticate with PKINIT to recover the NT hash via UnPAC-the-Hash. Step 2c (RBCD on a computer object): Create or control a computer account (default ms-DS-MachineAccountQuota allows this), use Rubeus s4u or Impacket rbcd.py to write msDS-AllowedToActOnBehalfOfOtherIdentity on the victim computer, then S4U2Self and S4U2Proxy to obtain a TGS as Domain Admin against the victim host. Step 2d (OU gPLink): Link a SYSVOL-hosted malicious GPO to the OU by writing gPLink; on next refresh, the GPO executes a scheduled task or immediate task on every child object. Step 3: Use harvested credentials or impersonation to pivot to Domain Controller compromise.
Cómo lo evalúa Guerrilla
Guerrilla binds to the target domain via System.DirectoryServices and reads nTSecurityDescriptor for each object in scope. It parses the DACL with ActiveDirectorySecurity.GetAccessRules, filters for AccessControlType.Allow ACEs whose ActiveDirectoryRights includes GenericWrite, then resolves the IdentityReference to a SID. SIDs are cross-referenced against a default-principals allowlist scoped to the object class (for example, Account Operators is default on user objects but not on Tier 0). For each remaining ACE, the check records the object DN, trustee SID and name, inheritance flags, and whether the trustee is a security-enabled group, computer, or user. The check correlates findings against AdminSDHolder protection and the Protected Users group to highlight ACEs over Tier 0 identities first.
Valor recomendado
Ningún principal no predeterminado con GenericWrite sobre objetos críticos de AD
Remediación
Audite las ACL de los objetos de usuario, equipo y grupo en busca de permisos GenericWrite. Elimine las ACE de GenericWrite innecesarias y sustitúyalas por permisos de escritura específicos a nivel de atributo. Preste especial atención al acceso de escritura sobre los atributos msDS-AllowedToActOnBehalfOfOtherIdentity, servicePrincipalName y msDS-KeyCredentialLink.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3
- ANSSI
- vuln_permissions_genericwrite
- MITRE ATT&CK
- T1222.001, T1098