ADSCRIPT-007: Permisos de scripts con escritura para todos
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- Critical
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los archivos de script individuales en NETLOGON o SYSVOL que conceden permisos de escritura o modificación a usuarios no administrativos pueden ser modificados por cualquier atacante con credenciales del dominio. Aunque los permisos a nivel de recurso compartido sean correctos, unos permisos NTFS a nivel de archivo excesivamente permisivos en scripts individuales crean una oportunidad de ejecución de código
Por qué importa
NETLOGON and SYSVOL are replicated by DFS-R to every domain controller and read by every domain-joined host. A script in those shares is, by design, executed under the security context of whatever principal runs it: the logged-on user for user logon scripts, SYSTEM for computer startup scripts, and frequently a service account or scheduled task identity for legacy login automation. If any non-Tier-0 principal can rewrite the file, that principal can append arbitrary code that will run on the next execution under a far more privileged context. The blast radius is the union of every host that runs the script. For a global logon script, that is the entire workstation fleet. For a computer startup script linked to the Domain Controllers OU, that is every DC, which means immediate Tier-0 compromise and trivial DCSync. The technique is silent: DFS-R will replicate the modified script across the forest within minutes, no security event is generated for an authorized NTFS write, and the malicious payload looks like a legitimate scheduled administrative task. Ransomware crews and red teams have used this primitive for years because it converts any domain user foothold into mass code execution without touching LSASS, kerberoasting, or any noisy primitive that EDR alerts on.
Ruta de ataque
1. Reconnaissance: from any domain-joined host, the attacker mounts \\<domain>\NETLOGON and \\<domain>\SYSVOL and enumerates files. PowerView (Get-DomainShare, Find-InterestingDomainShareFile), or a simple Get-ChildItem -Recurse, surfaces every script. 2. ACL audit: for each script the attacker runs Get-Acl <file> | Format-List, or icacls <file>, and looks for ACEs granting Write, Modify, or FullControl to Authenticated Users, Domain Users, Everyone, or any group the attacker is in. SharpHound with the FileACLs collection method automates this at scale. 3. Target selection: the attacker prefers files referenced by the scriptPath attribute on privileged user accounts (Get-ADUser -Filter "scriptPath -like '*'" -Properties scriptPath), or scripts linked to GPOs that target the Domain Controllers OU. A writable script that runs as SYSTEM on a DC is the highest-value primitive. 4. Weaponization: the attacker appends a payload to the existing script. For a .bat / .cmd, that is a single line that downloads and runs a beacon or adds a backdoor account. For a .ps1, the attacker appends a base64 -EncodedCommand that executes in the background and preserves the script's normal output so users see nothing unusual. For a referenced .exe, the attacker overwrites the binary with a wrapper that runs the payload then chains to the original. 5. Replication: DFS-R propagates the modified file to every DC within the default 60 second replication interval. From that moment forward, every logon, every GPO refresh that runs the script, and every scheduled task that invokes it executes the attacker payload under the calling principal. 6. Privilege escalation: when a Domain Admin next logs on to any workstation, the user logon script runs in the DA context and the attacker gets Tier-0. When a startup script linked to the Domain Controllers OU runs, the attacker gets SYSTEM on a DC. The attacker now runs DCSync or extracts the krbtgt hash and forges Golden Tickets. 7. Cleanup: the attacker reverts the script file to its original content and timestamps using touch-style metadata rewrites. The only forensic trace is the DFS-R event log entry showing a replicated file change, which is almost never reviewed.
Cómo lo evalúa Guerrilla
Guerrilla resolves the domain root via Get-ADDomain, builds the UNC paths \\<domain>\NETLOGON and \\<domain>\SYSVOL\<domain>\scripts, and recursively enumerates files with Get-ChildItem -Recurse -File -Force (the -Force flag includes hidden and system files that attackers commonly use). For each file the check calls Get-Acl and walks Access entries, evaluating FileSystemRights against a write-mask (WriteData, AppendData, WriteAttributes, WriteExtendedAttributes, Write, Modify, FullControl, ChangePermissions, TakeOwnership, Delete). IdentityReference is resolved through Translate([System.Security.Principal.SecurityIdentifier]) so well-known SIDs (S-1-1-0 Everyone, S-1-5-11 Authenticated Users, S-1-5-7 Anonymous Logon) surface even when the trustee cannot be translated to a friendly name. The check also walks per-GPO Machine\Scripts and User\Scripts directories under SYSVOL\<domain>\Policies because legacy script delegation often grants Edit Settings on the GPO container which translates to file write under SYSVOL. Findings are emitted with the full path, the trustee, the rights granted, AccessControlType (Allow vs Deny), whether the ACE is inherited, and the file extension so triage can prioritize executables and interpreted scripts over inert text files.
Valor recomendado
Todos los archivos de script en NETLOGON y SYSVOL con escritura únicamente para Domain Admins y SYSTEM; sin acceso de escritura para Domain Users o Authenticated Users
Remediación
Enumere los permisos NTFS de cada archivo del recurso compartido NETLOGON y de las carpetas de scripts de SYSVOL. Identifique los archivos en los que Domain Users, Authenticated Users, Everyone u otros grupos amplios tengan permisos de escritura, modificación o control total. Restablezca los permisos con icacls para conceder lectura y ejecución a Authenticated Users y control total únicamente a Domain Admins y SYSTEM.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-6, CM-5
- ANSSI
- vuln_writable_scripts
- MITRE ATT&CK
- T1222.001, T1059