ADACL-005: Permisos WriteOwner en objetos críticos
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El permiso WriteOwner permite cambiar el propietario de un objeto de AD. El propietario de un objeto tiene implícitamente la capacidad de modificar la DACL, lo que hace que WriteOwner sea funcionalmente equivalente a WriteDACL desde la perspectiva de un ataque. Un atacante puede tomar la propiedad y luego concederse los permisos que desee
Por qué importa
The owner of an AD object is granted READ_CONTROL and WRITE_DAC implicitly by the Windows security model, regardless of what the DACL says. An attacker with WriteOwner therefore controls the object in two ACL writes: change owner, then rewrite the DACL. On Tier-0 objects the blast radius is full domain compromise. WriteOwner on Domain Admins lets an attacker add themselves to the group. WriteOwner on AdminSDHolder propagates an attacker-controlled ACE to every protected group within 60 minutes via SDProp. WriteOwner on a Domain Controller computer object enables Resource-Based Constrained Delegation abuse and DCSync via msDS-AllowedToActOnBehalfOfOtherIdentity or by writing servicePrincipalName plus a logon target. WriteOwner is functionally indistinguishable from WriteDACL or GenericAll for attack purposes, but it is often overlooked during ACL audits because it does not appear in the default "Full Control" check in dsa.msc.
Ruta de ataque
Step 1: Reconnaissance. The attacker runs BloodHound or SharpHound with -CollectionMethod ACL, or queries nTSecurityDescriptor directly via LDAP. BloodHound surfaces the edge as "WriteOwner" with a built-in attack path to GenericAll. Step 2: Take ownership. Using the compromised principal, the attacker calls Set-ADObject -Replace @{nTSecurityDescriptor=...} or PowerView Set-DomainObjectOwner -Identity "Domain Admins" -OwnerIdentity attacker. Impacket dacledit.py and BloodyAD set-owner achieve the same from Linux. Step 3: Grant GenericAll. As the new owner, the attacker has implicit WRITE_DAC and adds a GenericAll ACE for their account using Add-DomainObjectAcl -Rights All or BloodyAD add genericAll. Step 4: Abuse the access. For a group, Add-DomainGroupMember adds the attacker. For AdminSDHolder, the ACE is mirrored to all protected groups by SDProp. For a computer, the attacker writes msDS-AllowedToActOnBehalfOfOtherIdentity for RBCD, then requests a Kerberos service ticket as any user via S4U2Self/S4U2Proxy (Rubeus s4u). For KRBTGT, the attacker resets the password and forges a Golden Ticket.
Cómo lo evalúa Guerrilla
Guerrilla performs an authenticated LDAP search with the SDFlagsControl (LDAP_SERVER_SD_FLAGS_OID, OwnerSecurityInformation | DaclSecurityInformation) to retrieve nTSecurityDescriptor on every target object. For each retrieved descriptor, the parser walks the DACL and emits an ACE record for entries where ((AccessMask & 0x00080000) != 0) and AceType is ACCESS_ALLOWED. Trustee SIDs are resolved against the domain and filtered against an allowlist of Tier-0 / default-by-design principals. Inherited ACEs are excluded by default unless --IncludeInherited is set, because inherited WriteOwner from AdminSDHolder onto protected groups is expected. The check also flags WriteOwner held by accounts that are themselves stale (lastLogonTimestamp older than 180 days), disabled, or kerberoastable, since those add a takeover path on top of the privilege.
Valor recomendado
Ningún principal no predeterminado con WriteOwner sobre objetos críticos de AD
Remediación
Audite los permisos WriteOwner sobre los objetos críticos. Elimine las ACE de WriteOwner para los principales no predeterminados. Verifique que los propietarios de los objetos sean cuentas privilegiadas apropiadas. Habilite la auditoría de cambios de propiedad y supervise el Event ID 4662 para las operaciones WriteOwner.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3
- ANSSI
- vuln_permissions_writeowner
- MITRE ATT&CK
- T1222.001, T1098