ADACL-010: Extended Rights Audit
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla reads the nTSecurityDescriptor of the domain naming context root and other sensitive containers (Configuration, Schema, AdminSDHolder, privileged OUs) and parses the DACL for ACEs of type ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x05) or ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0x0B). For each object-type ACE, the ObjectType GUID is matched against the dangerous-extended-rights list: - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 DS-Replication-Get-Changes - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 DS-Replication-Get-Changes-All - 89e95b76-444d-4c62-991a-0facbeda640c DS-Replication-Get-Changes-In-Filtered-Set - 00299570-246d-11d0-a768-00aa006e0529 User-Force-Change-Password - 45ec5156-db7e-47bb-b53f-dbeb2d03c40f Reanimate-Tombstones - 1131f6ab-9c07-11d1-f79f-00c04fc2dcd2 DS-Replication-Synchronize Trustees on each matching ACE are resolved via the SID and compared against an allowlist of expected principals (Domain Controllers group, Enterprise Domain Controllers, Administrators, the built-in replication accounts, and explicitly approved synchronization service identities). Any other trustee is reported as a finding.
Por qué importa
A single ACE granting DS-Replication-Get-Changes plus DS-Replication-Get-Changes-All on the domain object lets the trustee perform DCSync from any workstation: they can request replication of secret attributes (unicodePwd, ntPwdHistory, supplementalCredentials, pekList) for every account in the domain, including krbtgt. With the krbtgt hash an attacker forges Golden Tickets and persists indefinitely. User-Force-Change-Password grants the ability to reset any user password without knowing the current value, enabling targeted account takeover of Tier 0 identities without triggering password-change auditing on the trustee. Reanimate-Tombstones lets an attacker restore deleted privileged objects and inherit their group memberships. These rights are frequently granted by accident: legacy Azure AD Connect installers, third-party sync tools, IDM platforms, backup products, and helpdesk delegations have all been observed leaving DCSync-equivalent ACEs in place long after the product was decommissioned.
Ruta de ataque
1. Attacker compromises a low-privilege user that has been delegated an extended right on the domain object (often via group nesting). 2. Attacker enumerates ACLs using BloodHound or PowerView: Get-DomainObjectAcl -Identity "DC=corp,DC=local" -ResolveGUIDs | Where-Object ObjectAceType -match "Replication-Get-Changes". 3. If DS-Replication-Get-Changes and DS-Replication-Get-Changes-All are both present, attacker runs mimikatz lsadump::dcsync /domain:corp.local /user:krbtgt or secretsdump.py -just-dc corp/user@dc01 to extract the krbtgt hash. 4. With krbtgt, attacker forges a Golden Ticket (ticketer.py or Rubeus golden) granting arbitrary group membership, persisting through password resets. 5. Alternative path: a User-Force-Change-Password ACE on a Tier 0 OU lets the attacker reset a Domain Admin password directly via Set-DomainUserPassword, then authenticate interactively.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain via LDAP, requests the nTSecurityDescriptor attribute with the DACL_SECURITY_INFORMATION control (LDAP_SERVER_SD_FLAGS_OID 1.2.840.113556.1.4.801, value 7), and parses each ACE in memory. Extended-rights GUIDs are resolved against the schema (CN=Extended-Rights,CN=Configuration). Trustee SIDs are translated to NT account names and compared against the built-in expected-trustee list. Findings include the object DN, ACE flags, ObjectType GUID, resolved right name, and trustee. The detection also correlates with Event ID 4662 (operation on an object) where the Properties field contains the extended-rights GUID, providing runtime evidence of abuse.
Valor recomendado
Extended rights limited to default and explicitly authorized principals; DCSync rights only on domain controllers
Remediación
Enumerate all extended rights ACEs on the domain root and critical objects. Verify that DS-Replication-Get-Changes and DS-Replication-Get-Changes-All are only granted to domain controllers and authorized replication accounts. Remove any non-default extended rights grants. Monitor Event ID 4662 for extended rights usage.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(5), AU-12
- ANSSI
- vuln_dcsync_rights
- MITRE ATT&CK
- T1003.006, T1098