ADACL-013: Permisos de vinculación de GPO
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La capacidad de vincular objetos de directiva de grupo a sitios, dominios u OU controla qué directivas se aplican a qué objetos. Los permisos de vinculación de GPO no autorizados permiten a un atacante aplicar GPO maliciosos a OU específicas, con posibilidad de implementar malware, modificar la configuración de seguridad o crear tareas programadas en los equipos afectados
Por qué importa
Group Policy is a code execution channel that runs as SYSTEM on every joined machine in scope. A user who can write gPLink on an OU can link a GPO they control, or whose security filtering they can change, and that GPO will then execute startup scripts, scheduled tasks, Immediate Tasks, MSI installs, registry edits, and security setting changes on every computer in the OU on the next Group Policy refresh cycle (90 minutes by default, immediate at boot or logon). When the affected container is the Domain Controllers OU or the domain root, the blast radius includes domain controllers, which means tier zero compromise. When the affected container is a site object under CN=Sites, the link applies cross-domain to every computer in that site. This is the same primitive that BloodHound surfaces as the GPLink edge and that ATT&CK tracks as T1484.001.
Ruta de ataque
1. Attacker (or compromised low-privilege user) is identified by BloodHound as having a GenericWrite, WriteProperty, or WriteDacl edge against a target OU, the domain root, or a site object. 2. Attacker creates a new GPO in a container they can write to, or selects an existing GPO whose contents or security filtering they can modify. 3. Attacker writes a malicious payload into the GPO: a Scheduled Task with Immediate Task action under Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks, a startup script under Computer Configuration > Policies > Windows Settings > Scripts, or a Restricted Group entry that adds an attacker-controlled account to local Administrators. SharpGPOAbuse and pyGPOAbuse automate this step. 4. Attacker appends a gPLink reference to the target container using Set-ADObject, PowerView Set-DomainObject, or LDAP modify, pointing to the malicious GPO with the enforced flag (gPOptions bit 2) so user-level Block Inheritance cannot stop it. 5. Within one Group Policy refresh interval, every computer in scope executes the payload as NT AUTHORITY\SYSTEM. If the linked container was the Domain Controllers OU, the attacker now controls every DC.
Cómo lo evalúa Guerrilla
Guerrilla queries the directory using System.DirectoryServices for every objectClass in (organizationalUnit, domainDNS, site, container) under the partitions naming context. For each object, the nTSecurityDescriptor is read with SACL omitted, and the DACL is walked. For each ACE the check resolves the ObjectType GUID against the schema and tests for write rights on gPLink (f30e3bbe-9ff0-11d1-b603-0000f80367c1) or gPOptions (f30e3bbf-9ff0-11d1-b603-0000f80367c1), as well as the broader GenericWrite (0x00020028), GenericAll (0x000F01FF), WriteDacl (0x00040000), and WriteOwner (0x00080000) bits. The SID in each ACE is resolved through the local domain and forest trust path; any SID that does not map to an expected high-privilege group is emitted as a finding with the container DN, the granting ACE, the rights mask, and whether the ACE is inherited.
Valor recomendado
Permisos de vinculación de GPO restringidos únicamente a los administradores autorizados de directivas de grupo
Remediación
Audite los permisos de escritura sobre gPLink y gPOptions en todas las OU, la raíz del dominio y los objetos de sitio. Elimine los permisos de vinculación de GPO de los principales no administrativos. Utilice el modelado de directivas de grupo para verificar el impacto de las vinculaciones de GPO actuales. Implemente control de cambios para las operaciones de vinculación de GPO.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, CM-5
- ANSSI
- vuln_gpo_link_permissions
- MITRE ATT&CK
- T1484.001