ADACL-004: Permisos WriteDACL en objetos críticos
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El permiso WriteDACL permite a un principal modificar la lista de control de acceso discrecional de un objeto, lo que efectivamente le otorga la capacidad de asignarse cualquier permiso, incluido GenericAll, a sí mismo o a otros. Este es un vector crítico de escalada de privilegios, ya que permite a un atacante concederse control total sin poseerlo directamente
Por qué importa
WriteDACL is a privilege escalation primitive, not a privilege itself. A user holding WriteDACL on the domain head can add an ACE granting themselves DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, then run DCSync to extract the krbtgt hash and forge Golden Tickets. WriteDACL on AdminSDHolder is even more dangerous: SDProp re-applies the AdminSDHolder DACL onto every protected group (Domain Admins, Enterprise Admins, Schema Admins, Account Operators, Backup Operators, Server Operators, Print Operators, Replicator, Cert Publishers) every 60 minutes, so a single ACE is replicated to every privileged group in the forest. WriteDACL on a GPO linked to Domain Controllers grants code execution as SYSTEM on every DC at the next gpupdate. The misconfiguration is frequently introduced by helpdesk delegation wizards, legacy installers (Exchange pre-2019 CU, some PAM vendors), or by administrators who use "Full Control" in the Delegation of Control Wizard without understanding inheritance scope.
Ruta de ataque
1. Enumerate object ACLs with BloodHound (SharpHound -c DCOnly,ACL) or PowerView (Get-DomainObjectAcl -ResolveGUIDs). Filter for ActiveDirectoryRights -match "WriteDacl" and IdentityReferenceSid not in the default set. 2. Identify the shortest path from a controlled principal to a Tier 0 object. BloodHound's "Shortest Path to Domain Admins" or the AddAllowedToAct / WriteDacl edges expose this directly. 3. Add an ACE granting the attacker GenericAll on the target: Add-DomainObjectAcl -TargetIdentity "DC=corp,DC=local" -PrincipalIdentity attacker -Rights All, or the equivalent Set-Acl call against the AD: provider. 4. For a domain head target, instead of GenericAll add DS-Replication-Get-Changes (GUID 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) and DS-Replication-Get-Changes-All (GUID 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2). Then run secretsdump.py -just-dc or mimikatz lsadump::dcsync /user:krbtgt. 5. For an AdminSDHolder target, add GenericAll for the attacker. Wait up to 60 minutes for SDProp to replicate the ACE onto Domain Admins, Enterprise Admins, and every other protected group, or run Invoke-SDPropagator to force it. 6. For a GPO target, modify the GPT.INI / GptTmpl.inf / ScheduledTasks.xml to add the attacker to Local Administrators on every linked computer (SharpGPOAbuse or PowerView Set-DomainObject can do this in one call).
Cómo lo evalúa Guerrilla
Guerrilla binds to the configuration naming context, resolves the well-known SIDs for Domain Admins, Enterprise Admins, BUILTIN\Administrators, SYSTEM, Enterprise Domain Controllers, and the Pre-Windows 2000 Compatible Access group. For each Tier 0 object it reads nTSecurityDescriptor with the SACL flag cleared, walks the DACL, and emits a finding for every ACE where (AccessMask -band 0x00040000) -ne 0 -or (AccessMask -band 0x00080000) -ne 0 and the trustee SID is outside the allowlist. Inherited ACEs are tagged separately so the operator can fix the parent rather than the leaf. The check also queries the directory service event channel for Event ID 5136 (directory object modification) where the AccessMask matches WriteDACL, to surface recent changes alongside the static state.
Valor recomendado
Ningún principal no predeterminado con WriteDACL sobre objetos críticos de AD
Remediación
Enumere los permisos WriteDACL sobre todos los objetos críticos, incluidos la raíz del dominio, AdminSDHolder, los objetos GPO y los objetos de grupos privilegiados. Elimine WriteDACL para los principales no predeterminados. Habilite la auditoría de cambios de ACL (Event ID 5136) para detectar modificaciones de DACL no autorizadas. Revise los cambios periódicamente.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3, AU-12
- ANSSI
- vuln_permissions_writedacl
- MITRE ATT&CK
- T1222.001, T1098