ADSCRIPT-002: Permisos del recurso compartido SYSVOL
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El recurso compartido SYSVOL contiene plantillas de directiva de grupo, scripts y archivos de configuración que se aplican a todos los sistemas unidos al dominio. Unos permisos incorrectos en SYSVOL pueden permitir que usuarios no autorizados modifiquen la configuración de directiva de grupo, implementen scripts maliciosos o manipulen configuraciones de seguridad que afectan a todo el dominio
Por qué importa
SYSVOL is the only file share in the domain whose contents are executed by every machine and every user, by design, on a recurring schedule. The Group Policy engine on a member computer authenticates to \\<domain.fqdn>\SYSVOL\<domain.fqdn>\Policies\{GUID}\, reads gpt.ini, Registry.pol, the GPP XML files, and any referenced script, and applies them as SYSTEM (machine policy) or as the logged-on user (user policy). A principal who can write anywhere under SYSVOL can therefore: drop a malicious .bat or .ps1 into the scripts (NETLOGON) folder and have it run on every user logon; overwrite an existing logon-script file referenced by the userParameters.scriptPath attribute; tamper with Registry.pol under a GPO that is linked to the Domain Controllers OU to inject a startup task that runs as SYSTEM on every DC at the next refresh; modify GroupPolicyPreferences XML (Groups.xml, ScheduledTasks.xml, Services.xml) to add the attacker to local Administrators on every computer in scope; or weaponize a previously benign GPO simply by editing its files in place, bypassing the GPO ACL because the SYSVOL ACL is what actually gates the bytes. The blast radius is the whole domain (and, via cross-forest GPO references, potentially the whole forest). This is the file-system half of the same class of misconfiguration that BloodHound captures as the GPO write edge (T1484.001), and it is consistently among the highest-leverage abuse primitives identified in red team engagements against Active Directory.
Ruta de ataque
1. Discovery: with any authenticated domain account, the attacker mounts \\<domain.fqdn>\SYSVOL and walks the tree. PowerView (Find-InterestingDomainShareFile), SharpHound (-CollectionMethod GPOLocalGroup), or a simple icacls /Q /C walk reveals which folders grant Write, Modify, or FullControl to non-Tier-0 principals. Authenticated Users with Read is expected; Authenticated Users or Domain Users with Write is the finding. 2. Target selection: the attacker prioritises (a) the scripts (NETLOGON) folder, because anything dropped there is referenced by the legacy logon-script path and runs as the interactive user; (b) GPO {GUID} folders whose GPC is linked to the Domain Controllers OU or the Domain Root; (c) Groups.xml, ScheduledTasks.xml, or Services.xml under any GPO that ships a Group Policy Preferences extension. 3. Payload staging: the attacker either overwrites an existing referenced file (a logon script, Registry.pol, a GPP XML) or drops a new file and edits gpt.ini / Registry.pol to reference it. For a SYSTEM-as-DC path, the attacker uses SharpGPOAbuse-style techniques: inject a ScheduledTasks.xml that runs on next boot, increment the GPC versionNumber attribute (and the Version= line in gpt.ini), and wait for DFSR to replicate the change to every DC. 4. Execution: at the next Group Policy refresh on a targeted machine (default 90 minutes plus offset, or immediate via gpupdate /force, or on the next user logon for logon scripts), the Group Policy client-side extensions read the SYSVOL contents and execute them. Machine-side payloads run as NT AUTHORITY\SYSTEM; user-side payloads run as the logged-on user. 5. Persistence and cleanup: the attacker can leave the modified SYSVOL file in place (long-term persistence on every refresh) or revert it after execution, leaving only the GPC versionNumber bump as a forensic trace. SYSVOL has no per-file write auditing by default, so without object-access SACLs the change is invisible to the event log. 6. Lateral and Tier-0: a payload that runs as SYSTEM on a Domain Controller has DCSync, krbtgt, and arbitrary AD write rights. The path from Authenticated Users + SYSVOL write to Domain Admin is one GPO refresh long.
Cómo lo evalúa Guerrilla
Guerrilla enumerates every Domain Controller via Get-ADDomainController -Filter * and connects to each in turn. For each DC the cmdlet calls Get-SmbShareAccess -Name SYSVOL to capture the share-level ACL, then Get-Acl on \\<dc>\C$\Windows\SYSVOL\sysvol\, \\<dc>\C$\Windows\SYSVOL\sysvol\<domain.fqdn>\, the Policies subtree, and the scripts subtree (the NETLOGON share target). NTFS ACEs are normalised into IdentityReference, FileSystemRights, AccessControlType, IsInherited, and InheritanceFlags, and any Allow ACE that grants Write, Modify, FullControl, ChangePermissions, TakeOwnership, CreateFiles, or CreateFolders to a principal outside the Tier-0 allowlist is reported. For each GPO folder under Policies\{GUID}, the matching Group Policy Container object is read via LDAP and the two DACLs are compared; mismatches are flagged because that is the precise condition dcdiag /test:sysvolcheck and the gpotool / Group Policy infrastructure status check call INCONSISTENT. Per-DC output is compared across replicas so that a permission set present on only one DC (a partial replication or a single-DC tamper) is highlighted. The check does not attempt to write to SYSVOL; it is read-only and safe to run on production DCs.
Valor recomendado
Recurso compartido SYSVOL: Authenticated Users solo con acceso de lectura; el acceso de escritura se limita a Domain Admins y SYSTEM
Remediación
Audite los permisos NTFS del árbol de la carpeta SYSVOL en cada controlador de dominio. La carpeta raíz de SYSVOL debe conceder a Authenticated Users acceso de lectura y ejecución. Las subcarpetas de GPO deben coincidir con los permisos definidos en el objeto GPC correspondiente en Active Directory. Ejecute dcdiag /test:sysvolcheck para identificar problemas de permisos. Restablezca los permisos con icacls si es necesario.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-6, CM-5
- ANSSI
- vuln_sysvol_permissions
- MITRE ATT&CK
- T1484.001, T1222.001