ADACL-012: Non-Default Domain Root Permissions
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla reads the ntSecurityDescriptor attribute on the domain root object (the distinguishedName DC=<domain>,DC=<tld>) using the OWNER_SECURITY_INFORMATION, DACL_SECURITY_INFORMATION, and SACL_SECURITY_INFORMATION control flags. Each ACE in the DACL is normalised (Trustee SID, AccessMask, ObjectType GUID, InheritedObjectType GUID, AceFlags) and compared against the default ACL shipped by Microsoft for the forest functional level in use (Windows Server 2016, 2019, 2022, 2025). ACEs that are not part of the baseline are reported with: trustee resolution, the rights granted (GenericAll, WriteDacl, WriteOwner, WriteProperty, Self, Extended-Right including DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), the ObjectType GUID where applicable, and the inheritance scope. The owner of the object is also evaluated, since a non-default owner can re-write the DACL at will.
Por qué importa
The domain head is the parent of every container in the directory (Users, Computers, Domain Controllers, the Configuration NC root inherits separately but related rights apply). Because the default DACL on the domain root carries the CONTAINER_INHERIT_ACE and OBJECT_INHERIT_ACE flags on most ACEs, a write granted at the head is effectively a write everywhere unless explicitly blocked by an "Include inheritable permissions from this object" toggle further down. A single GenericAll, WriteDacl, or WriteOwner ACE granted to a compromised user, an over-delegated helpdesk group, or a stale service account converts that principal into a domain compromise primitive: the trustee can grant themselves DS-Replication-Get-Changes-All (DCSync), reset KRBTGT, modify the AdminSDHolder template, or change the owner of any privileged group. Many real-world domain takeovers begin with an inherited ACE on the domain root that nobody noticed for years.
Ruta de ataque
1. Enumeration. An attacker with any authenticated user identity runs BloodHound (SharpHound collector) or PowerView (Get-DomainObjectAcl -Identity (Get-Domain).DistinguishedName) and inspects the DACL on the domain head. BloodHound surfaces this as a GenericAll, WriteDacl, WriteOwner, GetChanges, or GetChangesAll edge from the controlled principal to the domain node. 2. Pivot selection. If WriteDacl or GenericAll is present, the attacker adds an explicit ACE that grants themselves DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) and DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2). If WriteOwner is present, they first change the owner to themselves, then re-write the DACL. 3. DCSync. Using mimikatz lsadump::dcsync, secretsdump.py, or impacket-secretsdump, the attacker replicates the krbtgt hash and any other account of interest. 4. Golden Ticket / persistence. With the krbtgt NTLM hash, the attacker mints golden tickets for arbitrary users at arbitrary trust paths and is no longer dependent on the original ACE. 5. Alternative paths. WriteProperty on the gPLink attribute of the domain root allows linking a malicious GPO to the entire domain; WriteProperty on msDS-AllowedToActOnBehalfOfOtherIdentity at any descendant enables Resource-Based Constrained Delegation attacks; Self on the member attribute permits adding the trustee to Domain Admins indirectly via inherited ACEs.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain head via LDAP (RootDSE -> defaultNamingContext), requests the ntSecurityDescriptor attribute with the appropriate SD control, and parses it with System.DirectoryServices.ActiveDirectorySecurity. The parsed ACL is diffed against an embedded reference set of default ACEs keyed by forest functional level. Findings include the trustee SID, the resolved trustee name (where resolvable), the ActiveDirectoryRights value, the ObjectType and InheritedObjectType GUIDs translated to schema attribute or class names, the InheritanceType, and whether the ACE is explicit or inherited. The check also flags any owner that is not Domain Admins, Enterprise Admins, or the built-in Administrators group, and any ACE granting the four sensitive extended rights: DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set, and Reanimate-Tombstones.
Valor recomendado
Only default Microsoft ACEs on the domain root; all custom ACEs documented and justified
Remediación
Compare current domain root ACL against the default ACL for your domain functional level. Document any non-default ACEs and validate their operational necessity. Remove ACEs that are no longer required or that grant excessive permissions. Pay special attention to ACEs that apply to 'This object and all descendant objects'.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3, CM-6
- MITRE ATT&CK
- T1222.001, T1003.006