ADSCRIPT-001: Permisos del recurso compartido NETLOGON
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El recurso compartido NETLOGON aloja scripts de inicio de sesión que se ejecutan en cada sistema unido al dominio durante el inicio de sesión del usuario. Unos permisos NTFS o de recurso compartido excesivamente permisivos en NETLOGON permiten que cualquier usuario autenticado modifique los scripts, habilitando la ejecución de código a gran escala. Solo los Domain Admins y los administradores autorizados deben tener acceso de escritura
Por qué importa
NETLOGON has three properties that make a single bad ACE catastrophic. First, the share is enumerated and read during every interactive logon by the Userenv / Group Policy client, so a planted script reaches every workstation in the domain within hours without any user action. Second, scripts in NETLOGON run in the context of the logging-on user, which means a workstation administrators logon executes the script with their token, and a Domain Admins logon to a workstation (a Tier-0 violation that still happens routinely) hands the attacker SYSTEM on a DC class principal. Third, NETLOGON is replicated by DFSR to every DC, so an attacker only needs to write to one DCs copy of the SYSVOL staging folder to achieve forest-wide distribution, and a defender who cleans one DC will see the malicious file return on the next replication cycle. Historically this is the same blast surface that made the GPP cpassword issue (MS14-025 / CVE-2014-1812) so destructive, but the script vector is broader because it does not require credentials in the file: any executable, .bat, .ps1, .vbs, or .cmd is enough.
Ruta de ataque
1. Reconnaissance: with any domain user credential the attacker mounts \\<domain>\NETLOGON and runs icacls or Get-Acl against the target paths. PowerView (Find-InterestingDomainShareFile, Get-DomainObjectAcl) and BloodHound CE (with the SharpHound SMB collection method, or the newer Sharp Suite share-permission collector) will surface NETLOGON write paths automatically as a high-value edge. 2. Edge identification: the attacker enumerates ACEs that grant Modify or Write to a group they already control, commonly an over-privileged helpdesk role, a stale Authenticated Users entry left over from a legacy migration, or a service account whose password they have cracked from a Kerberoast. 3. Weaponization: the attacker drops or modifies a script in NETLOGON. Two common patterns: replacing an existing logon.bat that is referenced from the User Object scriptPath attribute, or planting a new .bat / .ps1 that is wired into a GPO Logon Script preference under \\<domain>\SYSVOL\<domain>\Policies\{GUID}\User\Scripts\Logon. The payload is usually a one-line loader that calls back to a C2 (Cobalt Strike, Sliver, Mythic, Havoc) or stages an Impacket secretsdump if executed in admin context. 4. Propagation: DFSR replicates the modified file to every DC in the domain (default schedule is near-real-time on the SYSVOL replication group). Every interactive logon across the forest now executes the script with the logging-on users token. 5. Privilege escalation: the attacker waits for a Tier-1 server admin or a Tier-0 Domain Admin to log on to a domain-joined endpoint. The script captures the token, executes secretsdump against LSASS, or uses Rubeus to forge a TGT, and the attacker pivots to a DC. 6. Persistence: the malicious script is renamed to mimic a legitimate Microsoft script name (for example WindowsLogonNotification.cmd) and signed by an attacker-controlled code-signing cert if WDAC is in use. The ACE that permitted the write is left in place as a fallback.
Cómo lo evalúa Guerrilla
Guerrilla enumerates domain controllers via Get-ADDomainController -Filter *, then for each DC performs two remote ACL reads. The share DACL is collected through Get-SmbShareAccess -CimSession (which uses MS-SRVS / SMB2 IOCTL FSCTL_PIPE_TRANSCEIVE rather than legacy Net Use), and the NTFS DACL is collected through Get-Acl on the UNC path \\<DC>\SYSVOL\<domain>\SCRIPTS (which is the SMB-exported view of the NETLOGON content and is identical to the NETLOGON share contents). For each ACE the check resolves the trustee via Translate([Security.Principal.NTAccount]) against the DC, computes the effective rights mask, and compares the result to an expected-trustee baseline. The baseline excludes Domain Admins, Enterprise Admins, NT AUTHORITY\SYSTEM, BUILTIN\Administrators, the well-known CREATOR OWNER on file inheritance entries, and the SERVER OPERATORS group on legacy systems. Findings include the DC FQDN, the share or NTFS layer, the trustee NTAccount string and SID, the FileSystemRights / ShareAccessRight mask, the IsInherited flag, and the SDDL fragment so the result can be diffed across runs and across DCs.
Valor recomendado
Recurso compartido NETLOGON: Authenticated Users solo con acceso de lectura; el acceso de escritura se limita a Domain Admins y a los administradores de GPO autorizados
Remediación
Revise los permisos NTFS de la carpeta NETLOGON (normalmente %SystemRoot%\SYSVOL\sysvol\<domain>\Scripts) en cada controlador de dominio. Elimine los permisos de escritura, modificación o control total de los grupos no administrativos. Verifique que los permisos del recurso compartido coincidan con los permisos NTFS. Asegúrese de que los permisos sean coherentes en todos los controladores de dominio mediante la replicación DFSR.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-6, CM-5
- ANSSI
- vuln_netlogon_permissions
- MITRE ATT&CK
- T1059, T1222.001