ADACL-012: Permisos no predeterminados en la raíz del dominio
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El objeto raíz del dominio es la cúspide de la jerarquía de AD y los permisos establecidos aquí pueden heredarse por todo el directorio. Las ACE no predeterminadas sobre la raíz del dominio que otorguen derechos de escritura, modificación o extendidos a principales inesperados representan un riesgo significativo, ya que pueden afectar a todos los objetos del dominio
Por qué importa
The domain head is the parent of every container in the directory (Users, Computers, Domain Controllers, the Configuration NC root inherits separately but related rights apply). Because the default DACL on the domain root carries the CONTAINER_INHERIT_ACE and OBJECT_INHERIT_ACE flags on most ACEs, a write granted at the head is effectively a write everywhere unless explicitly blocked by an "Include inheritable permissions from this object" toggle further down. A single GenericAll, WriteDacl, or WriteOwner ACE granted to a compromised user, an over-delegated helpdesk group, or a stale service account converts that principal into a domain compromise primitive: the trustee can grant themselves DS-Replication-Get-Changes-All (DCSync), reset KRBTGT, modify the AdminSDHolder template, or change the owner of any privileged group. Many real-world domain takeovers begin with an inherited ACE on the domain root that nobody noticed for years.
Ruta de ataque
1. Enumeration. An attacker with any authenticated user identity runs BloodHound (SharpHound collector) or PowerView (Get-DomainObjectAcl -Identity (Get-Domain).DistinguishedName) and inspects the DACL on the domain head. BloodHound surfaces this as a GenericAll, WriteDacl, WriteOwner, GetChanges, or GetChangesAll edge from the controlled principal to the domain node. 2. Pivot selection. If WriteDacl or GenericAll is present, the attacker adds an explicit ACE that grants themselves DS-Replication-Get-Changes (1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) and DS-Replication-Get-Changes-All (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2). If WriteOwner is present, they first change the owner to themselves, then re-write the DACL. 3. DCSync. Using mimikatz lsadump::dcsync, secretsdump.py, or impacket-secretsdump, the attacker replicates the krbtgt hash and any other account of interest. 4. Golden Ticket / persistence. With the krbtgt NTLM hash, the attacker mints golden tickets for arbitrary users at arbitrary trust paths and is no longer dependent on the original ACE. 5. Alternative paths. WriteProperty on the gPLink attribute of the domain root allows linking a malicious GPO to the entire domain; WriteProperty on msDS-AllowedToActOnBehalfOfOtherIdentity at any descendant enables Resource-Based Constrained Delegation attacks; Self on the member attribute permits adding the trustee to Domain Admins indirectly via inherited ACEs.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain head via LDAP (RootDSE -> defaultNamingContext), requests the ntSecurityDescriptor attribute with the appropriate SD control, and parses it with System.DirectoryServices.ActiveDirectorySecurity. The parsed ACL is diffed against an embedded reference set of default ACEs keyed by forest functional level. Findings include the trustee SID, the resolved trustee name (where resolvable), the ActiveDirectoryRights value, the ObjectType and InheritedObjectType GUIDs translated to schema attribute or class names, the InheritanceType, and whether the ACE is explicit or inherited. The check also flags any owner that is not Domain Admins, Enterprise Admins, or the built-in Administrators group, and any ACE granting the four sensitive extended rights: DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set, and Reanimate-Tombstones.
Valor recomendado
Solo ACE predeterminadas de Microsoft en la raíz del dominio; todas las ACE personalizadas documentadas y justificadas
Remediación
Compare la ACL actual de la raíz del dominio con la ACL predeterminada correspondiente al nivel funcional de su dominio. Documente cualquier ACE no predeterminada y valide su necesidad operativa. Elimine las ACE que ya no sean necesarias o que otorguen permisos excesivos. Preste especial atención a las ACE que se aplican a 'Este objeto y todos los objetos descendientes'.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3, CM-6
- MITRE ATT&CK
- T1222.001, T1003.006