hunting-active-directory-acl-abuse-paths

Hunting Active Directory ACL abuse paths: when one granted right owns a privileged account

Every object in an Active Directory carries an access control list, and the rights on it decide who may change it. Most of those rights are mundane, but a handful hand control of the object to whoever holds them: the right to reset a password logs you in as that account, the right to write group membership adds you to a privileged group, a generic write lets you set a logon script or a delegation the account will honor, and taking ownership lets you rewrite the permissions to grant yourself anything. When one of these rights sits on a privileged object and is held by a low-privileged principal, that principal owns the object; when the object it then controls holds a right over a further object, the control chains. The bug is a right over a more privileged object held by a principal who should not control it. You hunt these by reading the permissions on privileged objects and tracing each dangerous right to the account it seizes.

When to use

• Directory object permissions may grant a standard user a write over a privileged user, group, or computer.
• A delegated-control grant on an organizational unit may reach objects more privileged than the grantee.
• A chain of object rights may lead from a low-privileged principal to a privileged account.

Scope check

Test object-permission abuse only in directories you own or are authorized to assess, on non-production or a lab domain, making only reversible changes to test objects you are permitted to modify and never seizing a real privileged account outside the authorization. A confirmed chain yields control of a privileged account, so keep every probe within scope. If you can't name the authorization, stop.

The loop

1. Establish which dangerous right the low-privileged principal actually holds over a privileged object first. For each privileged object, read its permissions and determine whether a low-privileged principal holds a right that seizes control: reset-password, write-membership, a generic write, write-owner, or take-ownership. This is the false-positive killer: a right to read the object, or a write over an object no more privileged than the principal, is not an escalation. Name the specific right and the object it controls before claiming a path.