ADSCRIPT-006: Contraseñas en texto plano en scripts
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- Critical
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los scripts que contienen contraseñas en texto plano en comandos net use, cadenas de conexión a bases de datos o asignaciones de variables exponen las credenciales a todo usuario del dominio autenticado que pueda leer el recurso compartido NETLOGON. Esto incluye contraseñas de cuentas de servicio, cuentas de bases de datos y recursos de red que pueden proporcionar rutas de movimiento lateral
Por qué importa
NETLOGON and SYSVOL are world-readable to Authenticated Users by design: every domain workstation needs to fetch logon scripts and GPO content during user logon. A plaintext password in any file under those shares is therefore disclosed to every domain user, every service account, every unmanaged BYOD device that ever joins, and every attacker who lands a single low-privileged foothold. The credentials harvested from these scripts are almost always high-value: service accounts that map drives across the estate, SQL sa accounts embedded in maintenance jobs, backup accounts with restore rights on file servers, vendor accounts used to bridge to third-party systems, and local administrator passwords burned into runas wrappers. Because the same script is often copied into multiple OUs over years, a single rotation rarely closes the exposure: the attacker still has the old password in a forgotten copy, and the password is frequently reused on local accounts across the fleet. This is one of the highest-ROI reconnaissance steps for ransomware affiliates: a single Get-ChildItem on SYSVOL frequently returns Domain Admin, SCCM service account, or SQL sa credentials within minutes of initial access.
Ruta de ataque
1. Initial foothold: the attacker compromises any domain user account (phishing, password spray, an unmanaged contractor laptop, a kiosk session). No privilege is required beyond Authenticated Users. 2. Recon: the attacker mounts the NETLOGON and SYSVOL shares and recursively reads every script. Typical one-liners include Get-ChildItem \\<domain>\SYSVOL -Recurse -Include *.bat,*.cmd,*.ps1,*.vbs | Select-String -Pattern "password|pwd|net use|ConvertTo-SecureString" or, from Linux, smbclient and grep. 3. Tooling: SharpHound collects SYSVOL content for the GPP cpassword path, and adversary toolkits (Snaffler from l0ss, PowerHuntShares from NetSPI, ManySweeper, SauronEye) automate the file walk and pattern match across every reachable file share. 4. Credential extraction: extracted credentials are tested against the domain. Service accounts with SPNs become Kerberoasting candidates if the cleartext fails; service accounts with logon rights to multiple hosts become lateral movement primitives directly. 5. Lateral movement: psexec, WinRM, or wmiexec with the harvested credential pivots to file servers, database servers, and management hosts. SQL accounts pulled from connection strings are used with xp_cmdshell or via the SQL service token to obtain SYSTEM on the database host. 6. Privilege escalation: if any harvested account is a member of Domain Admins, Backup Operators, Server Operators, or has Logon as a Service on a Domain Controller, the attacker reaches Tier-0 directly. Backup Operators in particular is enough to extract NTDS.dit and forge Golden Tickets. 7. Persistence: the attacker often plants a new logon script themselves (Scheduled Task or Group Policy Logon Script) referencing a SYSVOL payload, knowing defenders rarely audit SYSVOL contents.
Cómo lo evalúa Guerrilla
Guerrilla discovers the in-scope script paths in three ways. First, it resolves \\<domain>\NETLOGON and \\<domain>\SYSVOL\<domain>\scripts via the DFS referral served by the PDC emulator, which is the same path Group Policy uses. Second, it enumerates every GPO with a Logon, Logoff, Startup, or Shutdown extension and reads scripts.ini under Machine\Scripts and User\Scripts to find the actual referenced files (which may live in custom subfolders). Third, it queries every user object for the scriptPath attribute (legacy logon script path) and resolves those files in NETLOGON. Each candidate file is read once over SMB with the calling identity, matched against the regex set described in the whatItChecks section, and emitted with file path, line number, matched pattern class, owner, last-modified timestamp, and SHA-256. The scanner is read-only and operates over SMB so it works against any DC the caller can reach without RSAT or remote PowerShell. False positives (placeholders such as Password=CHANGEME or Password=$env:SecretFromVault) are tagged but still surfaced so the reviewer can confirm.
Valor recomendado
Ninguna contraseña en texto plano en ningún archivo de script; toda la autenticación utiliza seguridad integrada o almacenamiento seguro de credenciales
Remediación
Busque en todos los archivos de script patrones como 'net use * /user:', asignaciones de contraseñas en PowerShell o batch, cadenas de conexión con Password= o Pwd=, y llamadas WScript.Network.MapNetworkDrive con credenciales. Sustituya todo uso de credenciales en texto plano por autenticación integrada de Windows, el Administrador de credenciales o cuentas gMSA. Rote de inmediato todas las contraseñas expuestas.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1), SC-28, IA-5(7)
- ANSSI
- vuln_cleartext_password
- MITRE ATT&CK
- T1552.001, T1059