ADACL-006: Derechos ForceChangePassword
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El derecho extendido User-Force-Change-Password (también conocido como Reset Password) permite a un principal restablecer la contraseña de otro usuario sin conocer la contraseña actual. Cuando se concede a cuentas no privilegiadas o a grupos amplios, crea una vía directa de apropiación de cuentas que elude los requisitos normales de autenticación
Por qué importa
Force-Change-Password is the most direct privilege escalation primitive in Active Directory short of full GenericAll. Unlike credential theft, it requires no interaction with the target, no cracking, and no kerberoasting. The attacker simply rewrites the password, authenticates as the victim, and inherits every group membership, ACL grant, and SPN-bound resource the victim has. When the delegation lands on Tier 0 paths (Domain Admins, Enterprise Admins, schema-modifying groups) or on accounts with Kerberos delegation, the blast radius extends to full domain compromise. BloodHound treats ForceChangePassword as a first-class attack edge precisely because it is reliable, fast, and leaves minimal forensic residue beyond a 4724 event.
Ruta de ataque
1. Reconnaissance: the operator runs SharpHound or BloodHound.py with the default collection method. The ForceChangePassword edge is collected from the DACL of every user object. 2. Pathfinding: in BloodHound the analyst queries shortest path to Domain Admins (or to any high-value target). ForceChangePassword edges appear as a single hop. 3. Execution: from a Windows host the attacker runs Set-DomainUserPassword (PowerView), net user, or Set-ADAccountPassword. From Linux, net rpc password, samba-tool user setpassword, or Impacket's net.py and changepasswd.py against MS-SAMR or MS-LSAD. 4. Authentication: the attacker logs on as the now-controlled account, requests a TGT, and pivots. If the victim is a service account with constrained or unconstrained delegation, the attacker chains into Kerberos abuse (S4U2Self, RBCD). 5. Persistence: the password reset is logged but rarely alerted on outside Tier 0. Many environments still permit reset-then-revert workflows that hide the action inside legitimate helpdesk noise.
Cómo lo evalúa Guerrilla
Guerrilla performs an authenticated LDAP query against every object of class user (including computer-derived users and inetOrgPerson). For each object it reads nTSecurityDescriptor with the OWNER_SECURITY_INFORMATION and DACL_SECURITY_INFORMATION control flags, then walks each ACE. ACEs of type ACCESS_ALLOWED_OBJECT_ACE_TYPE with the ObjectType GUID 00299570-246d-11d0-a768-00aa006e0529 and an ActiveDirectoryRights value of ExtendedRight are surfaced. The trustee SID is resolved to a sAMAccountName and cross-referenced against the configured allowlist (default: Domain Admins, Enterprise Admins, Account Operators, and named helpdesk groups). Any unmatched principal generates a finding.
Valor recomendado
ForceChangePassword limitado únicamente a grupos autorizados de soporte técnico y administración; no concedido a cuentas no privilegiadas
Remediación
Enumere todos los principales con el derecho extendido User-Force-Change-Password sobre objetos de usuario. Verifique que cada delegación sea intencional y esté delimitada adecuadamente. Elimine los derechos de cualquier principal que no tenga una necesidad operativa documentada. Utilice delegación delimitada por OU en lugar de concesiones para todo el dominio.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5(1)
- ANSSI
- vuln_permissions_resetpassword
- MITRE ATT&CK
- T1098, T1078.002