WriteDACL
Summary
FSProtect ACL Alias
WriteDACL
AD Alias
Modify Permissions
Affected Object Types
Objects
Exploitation Certainty
Certain
AD Right
WriteDacl
AD Permission Guid
00000000-0000-0000-0000-000000000000
Description
The WriteDACL permission in Active Directory allows an account to modify the Discretionary Access Control List (DACL) of an object. The DACL is a critical component of an object's security descriptor, defining detailed access permissions for users and groups. It determines who can perform actions such as reading, writing, or executing operations on the object. This permission is fundamental for enforcing security boundaries, implementing granular access control, and ensuring that resources within the directory are accessed only by authorized entities.
However, if misconfigured, the WriteDACL permission allows an attacker can alter the DACL of an object to grant themselves or others additional permissions, such as full control over the object. This could allow the attacker to manipulate the object's settings, access sensitive data, or modify permissions further to propagate unauthorized access.
Identification
PowerShell
Active Directory Module
Using the ActiveDirectory PowerShell module, you can enumerate WriteDACL entries.
1. Find-WriteDACL function
2. Scan all domain objects
3. Exclude default admins for clear visibility
4. Using SearchBase to limit the searching scope
.NET Directory Services
By leveraging PowerShell’s built-in .NET DirectoryServices namespace, you can enumerate WriteDACL entries without relying on any external modules or dependencies.
1. Find-WriteDACLSimple function
2. Scan all domain objects
3. Scan a specific object
4. Exclude default admins for clear visibility
Active Directory Users and Computers
1. Open Active Directory Users and Computers on your Windows server.
2. Right-click on the domain name.
3. Select Properties from the context menu.
4. In the Properties window, navigate to the Security tab.
5. Click on the Advanced button to open the Advanced Security Settings dialog.
6. In the Advanced Security Settings window, locate and select the relevant Access Control Entry (ACE) for the user or group you wish to configure.
7. Click Edit to modify the selected ACE.
8. In the permissions list, locate and check the option Modify permissions.
9. Click OK to save your changes and close the dialogs.
Exploitation
After granting our controlled attacker account Full Control over the object, further exploitation can be carried out. For detailed techniques and scenarios, please refer to GenericAll.
The following examples demonstrate exploitation on Windows and Linux environments.
Windows
Grant FullControl access to the controlled user
Example:
Linux
Grant FullControl access to the controlled user
Example:
Mitigation
Access Control Entries identified as dangerous should be removed by following the steps below.
1. Open Active Directory Users and Computers, and activate Advanced Features option.
2. Double click the affected domain and open the Security tab.
3. In this tab, click the Advanced button and open the dangerous Access Control Entry.
4. Remove the Modify permissions right.
5. Click OK and Apply buttons for saving changes.
Detection
Adding new Access Control Entries to Active Directory objects modifies the ntSecurityDescriptor attribute of the objects themselves. These changes can be detected with the 5136 and 4662 Event IDs to identify dangerous modifications.
5136
A directory service object was modified.
ntSecurityDescriptor
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
4662
An operation was performed on an object.
AccessList, AccessMask
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
References
Last updated
Was this helpful?