ADACL-006: ForceChangePassword Rights
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check parses the nTSecurityDescriptor attribute of user objects in Active Directory and inspects every Access Control Entry (ACE) that grants the extended right with ObjectType GUID 00299570-246d-11d0-a768-00aa006e0529 (User-Force-Change-Password). For each match, it resolves the trustee SID, evaluates whether the principal is a member of a Tier 0 or approved helpdesk group, and flags ACEs granted to standard users, Authenticated Users, Domain Users, Everyone, or any custom group not explicitly whitelisted. Both explicit ACEs on the user object and inherited ACEs propagated from the parent OU are considered.
Por qué importa
Force-Change-Password is the most direct privilege escalation primitive in Active Directory short of full GenericAll. Unlike credential theft, it requires no interaction with the target, no cracking, and no kerberoasting. The attacker simply rewrites the password, authenticates as the victim, and inherits every group membership, ACL grant, and SPN-bound resource the victim has. When the delegation lands on Tier 0 paths (Domain Admins, Enterprise Admins, schema-modifying groups) or on accounts with Kerberos delegation, the blast radius extends to full domain compromise. BloodHound treats ForceChangePassword as a first-class attack edge precisely because it is reliable, fast, and leaves minimal forensic residue beyond a 4724 event.
Ruta de ataque
1. Reconnaissance: the operator runs SharpHound or BloodHound.py with the default collection method. The ForceChangePassword edge is collected from the DACL of every user object. 2. Pathfinding: in BloodHound the analyst queries shortest path to Domain Admins (or to any high-value target). ForceChangePassword edges appear as a single hop. 3. Execution: from a Windows host the attacker runs Set-DomainUserPassword (PowerView), net user, or Set-ADAccountPassword. From Linux, net rpc password, samba-tool user setpassword, or Impacket's net.py and changepasswd.py against MS-SAMR or MS-LSAD. 4. Authentication: the attacker logs on as the now-controlled account, requests a TGT, and pivots. If the victim is a service account with constrained or unconstrained delegation, the attacker chains into Kerberos abuse (S4U2Self, RBCD). 5. Persistence: the password reset is logged but rarely alerted on outside Tier 0. Many environments still permit reset-then-revert workflows that hide the action inside legitimate helpdesk noise.
Cómo lo evalúa Guerrilla
Guerrilla performs an authenticated LDAP query against every object of class user (including computer-derived users and inetOrgPerson). For each object it reads nTSecurityDescriptor with the OWNER_SECURITY_INFORMATION and DACL_SECURITY_INFORMATION control flags, then walks each ACE. ACEs of type ACCESS_ALLOWED_OBJECT_ACE_TYPE with the ObjectType GUID 00299570-246d-11d0-a768-00aa006e0529 and an ActiveDirectoryRights value of ExtendedRight are surfaced. The trustee SID is resolved to a sAMAccountName and cross-referenced against the configured allowlist (default: Domain Admins, Enterprise Admins, Account Operators, and named helpdesk groups). Any unmatched principal generates a finding.
Valor recomendado
ForceChangePassword limited to authorized helpdesk and admin groups only; not granted to non-privileged accounts
Remediación
Enumerate all principals with User-Force-Change-Password extended right on user objects. Verify each delegation is intentional and scoped appropriately. Remove rights from any principal that does not have a documented operational need. Use OU-scoped delegation rather than domain-wide grants.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5(1)
- ANSSI
- vuln_permissions_resetpassword
- MITRE ATT&CK
- T1098, T1078.002