ADSCRIPT-001: NETLOGON Share Permissions
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For each reachable domain controller the check evaluates two access layers on the NETLOGON share: 1. Share-level permissions returned by Get-SmbShareAccess -Name NETLOGON. The Microsoft default grants Everyone Read and Authenticated Users Change on legacy installs, or Authenticated Users Read on hardened builds. The check flags any Change or Full control ACE assigned to a non-administrative principal. 2. NTFS permissions on the backing filesystem path, typically %SystemRoot%\SYSVOL\sysvol\<FQDN>\SCRIPTS (a reparse-point junction into %SystemRoot%\SYSVOL\domain\scripts). The check reads the DACL via Get-Acl and parses every ACE for FileSystemRights of Modify, Write, WriteData, AppendData, WriteAttributes, WriteExtendedAttributes, Delete, ChangePermissions, TakeOwnership, or FullControl. Results are correlated across DCs so an ACE that is present on one DC but not on others (a sign of out-of-band tampering or broken DFSR replication) is surfaced as a separate finding. The check also records the SYSVOL replication engine (DFSR vs the legacy FRS) because FRS does not replicate ACL changes the same way and indicates a domain that has not completed the post-2008 SYSVOL migration.
Por qué importa
NETLOGON has three properties that make a single bad ACE catastrophic. First, the share is enumerated and read during every interactive logon by the Userenv / Group Policy client, so a planted script reaches every workstation in the domain within hours without any user action. Second, scripts in NETLOGON run in the context of the logging-on user, which means a workstation administrators logon executes the script with their token, and a Domain Admins logon to a workstation (a Tier-0 violation that still happens routinely) hands the attacker SYSTEM on a DC class principal. Third, NETLOGON is replicated by DFSR to every DC, so an attacker only needs to write to one DCs copy of the SYSVOL staging folder to achieve forest-wide distribution, and a defender who cleans one DC will see the malicious file return on the next replication cycle. Historically this is the same blast surface that made the GPP cpassword issue (MS14-025 / CVE-2014-1812) so destructive, but the script vector is broader because it does not require credentials in the file: any executable, .bat, .ps1, .vbs, or .cmd is enough.
Ruta de ataque
1. Reconnaissance: with any domain user credential the attacker mounts \\<domain>\NETLOGON and runs icacls or Get-Acl against the target paths. PowerView (Find-InterestingDomainShareFile, Get-DomainObjectAcl) and BloodHound CE (with the SharpHound SMB collection method, or the newer Sharp Suite share-permission collector) will surface NETLOGON write paths automatically as a high-value edge. 2. Edge identification: the attacker enumerates ACEs that grant Modify or Write to a group they already control, commonly an over-privileged helpdesk role, a stale Authenticated Users entry left over from a legacy migration, or a service account whose password they have cracked from a Kerberoast. 3. Weaponization: the attacker drops or modifies a script in NETLOGON. Two common patterns: replacing an existing logon.bat that is referenced from the User Object scriptPath attribute, or planting a new .bat / .ps1 that is wired into a GPO Logon Script preference under \\<domain>\SYSVOL\<domain>\Policies\{GUID}\User\Scripts\Logon. The payload is usually a one-line loader that calls back to a C2 (Cobalt Strike, Sliver, Mythic, Havoc) or stages an Impacket secretsdump if executed in admin context. 4. Propagation: DFSR replicates the modified file to every DC in the domain (default schedule is near-real-time on the SYSVOL replication group). Every interactive logon across the forest now executes the script with the logging-on users token. 5. Privilege escalation: the attacker waits for a Tier-1 server admin or a Tier-0 Domain Admin to log on to a domain-joined endpoint. The script captures the token, executes secretsdump against LSASS, or uses Rubeus to forge a TGT, and the attacker pivots to a DC. 6. Persistence: the malicious script is renamed to mimic a legitimate Microsoft script name (for example WindowsLogonNotification.cmd) and signed by an attacker-controlled code-signing cert if WDAC is in use. The ACE that permitted the write is left in place as a fallback.
Cómo lo evalúa Guerrilla
Guerrilla enumerates domain controllers via Get-ADDomainController -Filter *, then for each DC performs two remote ACL reads. The share DACL is collected through Get-SmbShareAccess -CimSession (which uses MS-SRVS / SMB2 IOCTL FSCTL_PIPE_TRANSCEIVE rather than legacy Net Use), and the NTFS DACL is collected through Get-Acl on the UNC path \\<DC>\SYSVOL\<domain>\SCRIPTS (which is the SMB-exported view of the NETLOGON content and is identical to the NETLOGON share contents). For each ACE the check resolves the trustee via Translate([Security.Principal.NTAccount]) against the DC, computes the effective rights mask, and compares the result to an expected-trustee baseline. The baseline excludes Domain Admins, Enterprise Admins, NT AUTHORITY\SYSTEM, BUILTIN\Administrators, the well-known CREATOR OWNER on file inheritance entries, and the SERVER OPERATORS group on legacy systems. Findings include the DC FQDN, the share or NTFS layer, the trustee NTAccount string and SID, the FileSystemRights / ShareAccessRight mask, the IsInherited flag, and the SDDL fragment so the result can be diffed across runs and across DCs.
Valor recomendado
NETLOGON share: Authenticated Users Read only; write access limited to Domain Admins and authorized GPO administrators
Remediación
Review NTFS permissions on the NETLOGON folder (typically %SystemRoot%\SYSVOL\sysvol\<domain>\Scripts) on each domain controller. Remove write, modify, or full control permissions for non-administrative groups. Verify share permissions match NTFS permissions. Ensure permissions are consistent across all domain controllers via DFSR replication.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-6, CM-5
- ANSSI
- vuln_netlogon_permissions
- MITRE ATT&CK
- T1059, T1222.001