ACL Abuse
Last updated
Last updated
ForceChangePassword abused with Set-DomainUserPassword.
AddMembers abused with Add-DomainGroupMember.
GenericAll abused with Set-DomainUserPassword or Add-DomainGroupMember.
GenericWrite abused with Set-DomainObject.
WriteOwner abused with Set-DomainObjectOwner.
WriteDACL abused with Add-DomainObjectACL.
AllExtendedRights abused with Set-DomainUserPassword or Add-DomainGroupMember.
At the lowest level, the Security Descriptor Definition Language is used in the nTSecurityDescriptor attribute (and on registry keys and NTFS files) to define the ACL. Fortunately, one does not need to know this level of detail in normal conditions.
But advanced administrators may want to write scripts or code that can correctly construct SDDL strings. Also the security templates (located at %systemroot%\security\templates) use SDDL if you manually edit them with a text editor instead of the MMC interface.manually editing these templates turns out to be the most effective way to manipulate them. It is most likely that you will simply need to be able to read a SDDL string.
Each nTSecurityDescriptor SDDL string is composed of 5 primary parts which correspond to the Header, DACL (D:), SACL (S:), primary group (G:)and owner (O:). Each of these parts is designated with the prefix noted in parenthesis. The header contains some record keeping information, along with 2 flags that designate whether the object is blocking inheritance for the SACL and DACL. The contents of both the primary group and owner parts are simply a single SID. The contents of both the SACL and DACL parts are a string with no fixed length. ACEs make up the contents of these strings. ACEs are enclosed within parenthesis, and there are 6 fields in each ACE. These 6 fields are separated by a semicolon delimiter. The fields are ACE type (allow/deny/audit), ACE flags (inheritance and audit settings), Permissions (list of incremental permissions), ObjectType (GUID), Inherited Object Type (GUID), and Trustee (SID).
Value
Description
“A”
ACCESS ALLOWED
“D”
ACCESS DENIED
“OA”
OBJECT ACCESS ALLOWED: ONLY APPLIES TO A SUBSET OF THE OBJECT(S).
“OD”
OBJECT ACCESS DENIED: ONLY APPLIES TO A SUBSET OF THE OBJECT(S).
“AU”
SYSTEM AUDIT
“AL”
SYSTEM ALARM
“OU”
OBJECT SYSTEM AUDIT
“OL”
OBJECT SYSTEM ALARM
Value
Description
“CI”
CONTAINER INHERIT: Child objects that are containers, such as directories, inherit the ACE as an explicit ACE.
“OI”
OBJECT INHERIT: Child objects that are not containers inherit the ACE as an explicit ACE.
“NP”
NO PROPAGATE: ONLY IMMEDIATE CHILDREN INHERIT THIS ACE.
“IO”
INHERITANCE ONLY: ACE DOESN’T APPLY TO THIS OBJECT, BUT MAY AFFECT CHILDREN VIA INHERITANCE.
“ID”
ACE IS INHERITED
“SA”
SUCCESSFUL ACCESS AUDIT
“FA”
FAILED ACCESS AUDIT
The Permissions are a list of the incremental permissions given (or denied/audited) to the trustee-these correspond to the permissions discussed earlier and are simply appended together. However, the incremental permissions are not the only permissions available. The table below lists all the permissions.
Value
Description
Hexadecimal Value
Binary Bits from 0
Generic access rights
“GA”
GENERIC ALL
0x10000000
Bit 28
“GR”
GENERIC READ
0x80000000
Bit 31
“GW”
GENERIC WRITE
0x40000000
Bit 30
“GX”
GENERIC EXECUTE
0x20000000
Bit 29
Directory service access rights
“RC”
Read Permissions
0x20000
Bit 17
“SD”
Delete
0x10000
Bit 16
“WD”
Modify Permissions
0x40000
Bit 18
“WO”
Modify Owner
0x80000
Bit 19
“RP”
Read All Properties
0x00000010
Bit 4
“WP”
Write All Properties
0x00000020
Bit 5
“CC”
Create All Child Objects
0x00000001
Bit 0
“DC”
Delete All Child Objects
0x00000002
Bit 1
“LC”
List Contents
0x00000004
Bit 2
“SW”
All Validated Writes
0x00000008
Bit 3
“LO”
List Object
0x00000080
Bit 7
“DT”
Delete Subtree
0x00000040
Bit 6
“CR”
All Extended Rights
0x00000100
Bit 8
File access rights
“FA”
FILE ALL ACCESS
“FR”
FILE GENERIC READ
“FW”
FILE GENERIC WRITE
“FX”
FILE GENERIC EXECUTE
Registry key access rights
“KA”
KEY ALL ACCESS
0xF003F
“KR”
KEY READ
0x20019
“KW”
KEY WRITE
0x20006
“KX”
KEY EXECUTE
0x20019
KEY CREATE SUB KEYS
0x0004
KEY ENUMERATE SUB KEYS
0x0008
KEY NOTIFY
0x0010
KEY QUERY VALUE
0x0001
KEY SET VALUE
0x0002
The ObjectType is a GUID representing an object class, attribute, attribute set, or extended right. If present it limits the ACE to the object the GUID represents. The Inherited Object Type is a GUID representing an object class. If present it limits inheritance of the ACE to the child entries of only that object class.
Value
Description
“AO”
Account operators
“RU”
Alias to allow previous Windows 2000
“AN”
Anonymous logon
“AU”
Authenticated users
“BA”
Built-in administrators
“BG”
Built-in guests
“BO”
Backup operators
“BU”
Built-in users
“CA”
Certificate server administrators
“CG”
Creator group
“CO”
Creator owner
“DA”
Domain administrators
“DC”
Domain computers
“DD”
Domain controllers
“DG”
Domain guests
“DU”
Domain users
“EA”
Enterprise administrators
“ED”
Enterprise domain controllers
“WD”
Everyone
“PA”
Group Policy administrators
“IU”
Interactively logged-on user
“LA”
Local administrator
“LG”
Local guest
“LS”
Local service account
“SY”
Local system
“NU”
Network logon user
“NO”
Network configuration operators
“NS”
Network service account
“PO”
Printer operators
“PS”
Personal self
“PU”
Power users
“RS”
RAS servers group
“RD”
Terminal server users
“RE”
Replicator
“RC”
Restricted code
“SA”
Schema administrators
“SO”
Server operators
“SU”
Service logon user
Let's say that the ACE on object A applies to object B. This grants or denies object B access to object A with the specified access rights.
ACE example in SDDL format:
Enumerate ACLs which snovvcrash user possesses against j.doe user:
Enumerate which users possess GenericAll or AllExtendedRights permission against j.doe user:
PowerView analog:
Find all users who can DCSync and convert their SIDs to names:
Search for interesting ACLs:
Check if the attacker "MEGACORP\sbauer" has GenericWrite permissions on the "jorden" user object:
Search for interesting ACLs:
Check if the attacker "MEGACORP\sbauer" (S-1-5-21-3167813660-1240564177-918740779-3102) has GenericWrite permissions on the "jorden" user object:
PowerView 3.0 does not return IdentityReference property, which makes it less handy for this task (however, you may filter the output by the attacker's SID). To automatically convert SIDs to names we can use the following loop:
The Trustee is the SID of the user or group being given access (or denied or audited). Instead of a SID, there are several commonly used acronyms for well-known SIDs. The most common are listed in the table below, but you can review more at :
