ADACL-004: WriteDACL Permissions on Critical Objects
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates the nTSecurityDescriptor attribute of Tier 0 objects, parses every ACE in the DACL, and reports any ACE that grants ADS_RIGHT_WRITE_DAC (0x00040000) or ADS_RIGHT_WRITE_OWNER (0x00080000) to a principal that is not in the well-known default set (Domain Admins, Enterprise Admins, BUILTIN\Administrators, SYSTEM, Self on specific containers). Objects inspected include the domain naming context root, CN=AdminSDHolder,CN=System,DC=..., OU=Domain Controllers, the Configuration and Schema partition heads, every member of the Protected Users / Tier 0 admin groups, and the gPCFileSysPath of GPOs linked at the domain or OU=Domain Controllers scope. The check also reports inherited ACEs that propagate WriteDACL down a Tier 0 subtree, since BloodHound treats those edges as equivalent to direct grants.
Por qué importa
WriteDACL is a privilege escalation primitive, not a privilege itself. A user holding WriteDACL on the domain head can add an ACE granting themselves DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, then run DCSync to extract the krbtgt hash and forge Golden Tickets. WriteDACL on AdminSDHolder is even more dangerous: SDProp re-applies the AdminSDHolder DACL onto every protected group (Domain Admins, Enterprise Admins, Schema Admins, Account Operators, Backup Operators, Server Operators, Print Operators, Replicator, Cert Publishers) every 60 minutes, so a single ACE is replicated to every privileged group in the forest. WriteDACL on a GPO linked to Domain Controllers grants code execution as SYSTEM on every DC at the next gpupdate. The misconfiguration is frequently introduced by helpdesk delegation wizards, legacy installers (Exchange pre-2019 CU, some PAM vendors), or by administrators who use "Full Control" in the Delegation of Control Wizard without understanding inheritance scope.
Ruta de ataque
1. Enumerate object ACLs with BloodHound (SharpHound -c DCOnly,ACL) or PowerView (Get-DomainObjectAcl -ResolveGUIDs). Filter for ActiveDirectoryRights -match "WriteDacl" and IdentityReferenceSid not in the default set. 2. Identify the shortest path from a controlled principal to a Tier 0 object. BloodHound's "Shortest Path to Domain Admins" or the AddAllowedToAct / WriteDacl edges expose this directly. 3. Add an ACE granting the attacker GenericAll on the target: Add-DomainObjectAcl -TargetIdentity "DC=corp,DC=local" -PrincipalIdentity attacker -Rights All, or the equivalent Set-Acl call against the AD: provider. 4. For a domain head target, instead of GenericAll add DS-Replication-Get-Changes (GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) and DS-Replication-Get-Changes-All (GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2). Then run secretsdump.py -just-dc or mimikatz lsadump::dcsync /user:krbtgt. 5. For an AdminSDHolder target, add GenericAll for the attacker. Wait up to 60 minutes for SDProp to replicate the ACE onto Domain Admins, Enterprise Admins, and every other protected group, or run Invoke-SDPropagator to force it. 6. For a GPO target, modify the GPT.INI / GptTmpl.inf / ScheduledTasks.xml to add the attacker to Local Administrators on every linked computer (SharpGPOAbuse or PowerView Set-DomainObject can do this in one call).
Cómo lo evalúa Guerrilla
Guerrilla binds to the configuration naming context, resolves the well-known SIDs for Domain Admins, Enterprise Admins, BUILTIN\Administrators, SYSTEM, Enterprise Domain Controllers, and the Pre-Windows 2000 Compatible Access group. For each Tier 0 object it reads nTSecurityDescriptor with the SACL flag cleared, walks the DACL, and emits a finding for every ACE where (AccessMask -band 0x00040000) -ne 0 -or (AccessMask -band 0x00080000) -ne 0 and the trustee SID is outside the allowlist. Inherited ACEs are tagged separately so the operator can fix the parent rather than the leaf. The check also queries the directory service event channel for Event ID 5136 (directory object modification) where the AccessMask matches WriteDACL, to surface recent changes alongside the static state.
Valor recomendado
No non-default principals with WriteDACL on critical AD objects
Remediación
Enumerate WriteDACL permissions on all critical objects including the domain root, AdminSDHolder, GPO objects, and privileged group objects. Remove WriteDACL for non-default principals. Enable auditing of ACL changes (Event ID 5136) to detect unauthorized DACL modifications. Review changes regularly.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3, AU-12
- ANSSI
- vuln_permissions_writedacl
- MITRE ATT&CK
- T1222.001, T1098