ADSCRIPT-006: Plaintext Passwords in Scripts
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- Critical
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates every readable file under \\<domain>\NETLOGON and \\<domain>\SYSVOL\<domain>\scripts (plus any custom script paths referenced by GPO Logon / Logoff / Startup / Shutdown extensions and User scriptPath attributes). For each file with a script extension (.bat, .cmd, .ps1, .psm1, .vbs, .vbe, .js, .wsf, .kix, .pl, .py) it reads the content and applies a set of regular expressions: - net use [drive|*] \\... /user:<account> <password> - net user <account> <password> - runas /user:... with a password supplied via echo or a here-string - WScript.Network.MapNetworkDrive("...", "...", False, "user", "password") - PowerShell variable assignments: $Password, $Pwd, $Pass, $SecurePass = "..." - ConvertTo-SecureString -AsPlainText -Force on a string literal - New-Object System.Net.NetworkCredential("user","password") - Database connection strings: Password=, Pwd=, User Id=...;Password=... - LDAP bind strings: LDAP://... with a password literal - schtasks /create ... /RP <password> and /RU <user> - psexec \\host -u <user> -p <password> - sqlcmd -U <user> -P <password> - ftp / wget / curl / Invoke-WebRequest with -Credential or inline user:pass@host URLs The check also surfaces the file owner, last modified timestamp, ACL of the file, and the SHA-256 hash so analysts can attribute the script and pivot to copies elsewhere on the network. SYSVOL Group Policy Preferences XML files (Groups.xml, Services.xml, ScheduledTasks.xml, DataSources.xml, Printers.xml, Drives.xml) containing a cpassword attribute are covered separately by ADGPO-003 and are not re-reported here, but the regex set will still flag plaintext credentials embedded in custom XML or .config files staged alongside scripts.
Por qué importa
NETLOGON and SYSVOL are world-readable to Authenticated Users by design: every domain workstation needs to fetch logon scripts and GPO content during user logon. A plaintext password in any file under those shares is therefore disclosed to every domain user, every service account, every unmanaged BYOD device that ever joins, and every attacker who lands a single low-privileged foothold. The credentials harvested from these scripts are almost always high-value: service accounts that map drives across the estate, SQL sa accounts embedded in maintenance jobs, backup accounts with restore rights on file servers, vendor accounts used to bridge to third-party systems, and local administrator passwords burned into runas wrappers. Because the same script is often copied into multiple OUs over years, a single rotation rarely closes the exposure: the attacker still has the old password in a forgotten copy, and the password is frequently reused on local accounts across the fleet. This is one of the highest-ROI reconnaissance steps for ransomware affiliates: a single Get-ChildItem on SYSVOL frequently returns Domain Admin, SCCM service account, or SQL sa credentials within minutes of initial access.
Ruta de ataque
1. Initial foothold: the attacker compromises any domain user account (phishing, password spray, an unmanaged contractor laptop, a kiosk session). No privilege is required beyond Authenticated Users. 2. Recon: the attacker mounts the NETLOGON and SYSVOL shares and recursively reads every script. Typical one-liners include Get-ChildItem \\<domain>\SYSVOL -Recurse -Include *.bat,*.cmd,*.ps1,*.vbs | Select-String -Pattern "password|pwd|net use|ConvertTo-SecureString" or, from Linux, smbclient and grep. 3. Tooling: SharpHound collects SYSVOL content for the GPP cpassword path, and adversary toolkits (Snaffler from l0ss, PowerHuntShares from NetSPI, ManySweeper, SauronEye) automate the file walk and pattern match across every reachable file share. 4. Credential extraction: extracted credentials are tested against the domain. Service accounts with SPNs become Kerberoasting candidates if the cleartext fails; service accounts with logon rights to multiple hosts become lateral movement primitives directly. 5. Lateral movement: psexec, WinRM, or wmiexec with the harvested credential pivots to file servers, database servers, and management hosts. SQL accounts pulled from connection strings are used with xp_cmdshell or via the SQL service token to obtain SYSTEM on the database host. 6. Privilege escalation: if any harvested account is a member of Domain Admins, Backup Operators, Server Operators, or has Logon as a Service on a Domain Controller, the attacker reaches Tier-0 directly. Backup Operators in particular is enough to extract NTDS.dit and forge Golden Tickets. 7. Persistence: the attacker often plants a new logon script themselves (Scheduled Task or Group Policy Logon Script) referencing a SYSVOL payload, knowing defenders rarely audit SYSVOL contents.
Cómo lo evalúa Guerrilla
Guerrilla discovers the in-scope script paths in three ways. First, it resolves \\<domain>\NETLOGON and \\<domain>\SYSVOL\<domain>\scripts via the DFS referral served by the PDC emulator, which is the same path Group Policy uses. Second, it enumerates every GPO with a Logon, Logoff, Startup, or Shutdown extension and reads scripts.ini under Machine\Scripts and User\Scripts to find the actual referenced files (which may live in custom subfolders). Third, it queries every user object for the scriptPath attribute (legacy logon script path) and resolves those files in NETLOGON. Each candidate file is read once over SMB with the calling identity, matched against the regex set described in the whatItChecks section, and emitted with file path, line number, matched pattern class, owner, last-modified timestamp, and SHA-256. The scanner is read-only and operates over SMB so it works against any DC the caller can reach without RSAT or remote PowerShell. False positives (placeholders such as Password=CHANGEME or Password=$env:SecretFromVault) are tagged but still surfaced so the reviewer can confirm.
Valor recomendado
No plaintext passwords in any script files; all authentication uses integrated security or secure credential storage
Remediación
Search all script files for patterns such as 'net use * /user:', password assignments in PowerShell or batch, connection strings with Password= or Pwd=, and WScript.Network.MapNetworkDrive calls with credentials. Replace all plaintext credential usage with Windows integrated authentication, Credential Manager, or gMSA accounts. Rotate all exposed passwords immediately.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1), SC-28, IA-5(7)
- ANSSI
- vuln_cleartext_password
- MITRE ATT&CK
- T1552.001, T1059