ADSCRIPT-002: SYSVOL Share Permissions
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For every Domain Controller, the check reads: - The SMB share permissions on the SYSVOL share itself (Get-SmbShareAccess SYSVOL): expected baseline is Authenticated Users Read, Administrators Full, plus the staged shares (NETLOGON) inheriting from the same root - The NTFS DACL on %SystemRoot%\SYSVOL\sysvol (the share target), on the per-domain folder (\sysvol\<domain.fqdn>), on the Policies subfolder, and on the scripts (NETLOGON) subfolder - Each GPO subfolder under Policies\{GUID}: the NTFS DACL must mirror the DACL of the corresponding Group Policy Container (GPC) object in CN=Policies,CN=System (this is what dcdiag /test:sysvolcheck and the GPO infrastructure status report verify) - The owner of each folder in the tree (expected: Domain Admins or SYSTEM; a non-Tier-0 owner indicates tampering or accidental privilege) - Any Allow ACE granting WriteData, AppendData, WriteAttributes, WriteExtendedAttributes, CreateFiles, CreateFolders, Delete, ChangePermissions, or TakeOwnership to a principal outside the allowlist (Domain Admins, Enterprise Admins, SYSTEM, Creator Owner, plus the DC computer accounts via Domain Controllers group) - Whether inheritance is enabled or broken at each level (an unexpected protected DACL is suspicious because it can hide ACEs from a top-down audit) - The DFSR or FRS replication state on the SYSVOL content set, since a permission set that exists on only one DC indicates either replication failure or a recent tamper that has not converged The check uses Get-SmbShareAccess for share permissions, Get-Acl on each path for NTFS DACLs, and a directory-services search for the matching GPC DACL to detect SYSVOL / GPC permission skew (the condition GPO infrastructure status calls out as INCONSISTENT). All findings are emitted per-DC so that a single divergent replica is visible against the rest of the set.
Por qué importa
SYSVOL is the only file share in the domain whose contents are executed by every machine and every user, by design, on a recurring schedule. The Group Policy engine on a member computer authenticates to \\<domain.fqdn>\SYSVOL\<domain.fqdn>\Policies\{GUID}\, reads gpt.ini, Registry.pol, the GPP XML files, and any referenced script, and applies them as SYSTEM (machine policy) or as the logged-on user (user policy). A principal who can write anywhere under SYSVOL can therefore: drop a malicious .bat or .ps1 into the scripts (NETLOGON) folder and have it run on every user logon; overwrite an existing logon-script file referenced by the userParameters.scriptPath attribute; tamper with Registry.pol under a GPO that is linked to the Domain Controllers OU to inject a startup task that runs as SYSTEM on every DC at the next refresh; modify GroupPolicyPreferences XML (Groups.xml, ScheduledTasks.xml, Services.xml) to add the attacker to local Administrators on every computer in scope; or weaponize a previously benign GPO simply by editing its files in place, bypassing the GPO ACL because the SYSVOL ACL is what actually gates the bytes. The blast radius is the whole domain (and, via cross-forest GPO references, potentially the whole forest). This is the file-system half of the same class of misconfiguration that BloodHound captures as the GPO write edge (T1484.001), and it is consistently among the highest-leverage abuse primitives identified in red team engagements against Active Directory.
Ruta de ataque
1. Discovery: with any authenticated domain account, the attacker mounts \\<domain.fqdn>\SYSVOL and walks the tree. PowerView (Find-InterestingDomainShareFile), SharpHound (-CollectionMethod GPOLocalGroup), or a simple icacls /Q /C walk reveals which folders grant Write, Modify, or FullControl to non-Tier-0 principals. Authenticated Users with Read is expected; Authenticated Users or Domain Users with Write is the finding. 2. Target selection: the attacker prioritises (a) the scripts (NETLOGON) folder, because anything dropped there is referenced by the legacy logon-script path and runs as the interactive user; (b) GPO {GUID} folders whose GPC is linked to the Domain Controllers OU or the Domain Root; (c) Groups.xml, ScheduledTasks.xml, or Services.xml under any GPO that ships a Group Policy Preferences extension. 3. Payload staging: the attacker either overwrites an existing referenced file (a logon script, Registry.pol, a GPP XML) or drops a new file and edits gpt.ini / Registry.pol to reference it. For a SYSTEM-as-DC path, the attacker uses SharpGPOAbuse-style techniques: inject a ScheduledTasks.xml that runs on next boot, increment the GPC versionNumber attribute (and the Version= line in gpt.ini), and wait for DFSR to replicate the change to every DC. 4. Execution: at the next Group Policy refresh on a targeted machine (default 90 minutes plus offset, or immediate via gpupdate /force, or on the next user logon for logon scripts), the Group Policy client-side extensions read the SYSVOL contents and execute them. Machine-side payloads run as NT AUTHORITY\SYSTEM; user-side payloads run as the logged-on user. 5. Persistence and cleanup: the attacker can leave the modified SYSVOL file in place (long-term persistence on every refresh) or revert it after execution, leaving only the GPC versionNumber bump as a forensic trace. SYSVOL has no per-file write auditing by default, so without object-access SACLs the change is invisible to the event log. 6. Lateral and Tier-0: a payload that runs as SYSTEM on a Domain Controller has DCSync, krbtgt, and arbitrary AD write rights. The path from Authenticated Users + SYSVOL write to Domain Admin is one GPO refresh long.
Cómo lo evalúa Guerrilla
Guerrilla enumerates every Domain Controller via Get-ADDomainController -Filter * and connects to each in turn. For each DC the cmdlet calls Get-SmbShareAccess -Name SYSVOL to capture the share-level ACL, then Get-Acl on \\<dc>\C$\Windows\SYSVOL\sysvol\, \\<dc>\C$\Windows\SYSVOL\sysvol\<domain.fqdn>\, the Policies subtree, and the scripts subtree (the NETLOGON share target). NTFS ACEs are normalised into IdentityReference, FileSystemRights, AccessControlType, IsInherited, and InheritanceFlags, and any Allow ACE that grants Write, Modify, FullControl, ChangePermissions, TakeOwnership, CreateFiles, or CreateFolders to a principal outside the Tier-0 allowlist is reported. For each GPO folder under Policies\{GUID}, the matching Group Policy Container object is read via LDAP and the two DACLs are compared; mismatches are flagged because that is the precise condition dcdiag /test:sysvolcheck and the gpotool / Group Policy infrastructure status check call INCONSISTENT. Per-DC output is compared across replicas so that a permission set present on only one DC (a partial replication or a single-DC tamper) is highlighted. The check does not attempt to write to SYSVOL; it is read-only and safe to run on production DCs.
Valor recomendado
SYSVOL share: Authenticated Users Read only; write access limited to Domain Admins and SYSTEM
Remediación
Audit NTFS permissions on the SYSVOL folder tree on each domain controller. The root SYSVOL folder should grant Authenticated Users Read and Execute. GPO subfolders should match the permissions defined on the corresponding GPC object in AD. Run dcdiag /test:sysvolcheck to identify permission issues. Reset permissions using icacls if necessary.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-6, CM-5
- ANSSI
- vuln_sysvol_permissions
- MITRE ATT&CK
- T1484.001, T1222.001