WriteOwner
WriteOwner
Summary
FSProtect ACL Alias
WriteOwner
AD Alias
Modify Owner
Affected Object Types
Users, Groups, Computers, Domains
Exploitation Certainty
Certain
AD Right
WriteOwner
Description
The WriteOwner permission in Active Directory allows a user to change the ownership of an object, such as user accounts, groups, or computers. This permission is essential for administrative tasks, enabling proper delegation and management within the directory.
However, if misconfigured, the WriteOwner permission can pose significant security risks. An attacker with this permission can assign ownership of an object to themselves. nce ownership is taken, the attacker can modify the object's permissions to grant themselves additional rights, such as full control. This can lead to unauthorized access, privilege escalation, and persistent access within the system.
Identification
PowerShell
Active Directory Module
Using the ActiveDirectory PowerShell module, you can enumerate WriteOwner entries.
1. Find-WriteOwner Function
2. Scan all domain objects
3. Scan a specific object
4. Exclude default admins for clear visibility
5. Using SearchBase to limit the Scope
.NET Directory Services
By leveraging PowerShell’s built-in .NET DirectoryServices namespace, you can enumerate WriteOwner entries without relying on any external modules or dependencies.
1. Find-WriteOwnerSimple Function
2. Scan all domain objects
3. Scan a specific object
4. Exclude default admins for clear visibility
5. Using SearchBase to limit the Scope
Active Directory Users and Computers
1. Open Active Directory Users and Computers on your Windows server.
2. Right-click on the Object name.
3. Select Properties from the context menu.
4. In the Properties window, navigate to the Security tab.
5. Click the Advanced button to open the Advanced Security Settings dialog.
6. In the Advanced Security Settings window, locate and select the relevant Access Control Entry (ACE) for the user or group you wish to configure.
7. Click Edit to modify the selected ACE.
8. In the permissions list, locate and select the Modify owner permission.
9. Click OK to save your changes and close the dialogs.
Exploitation
After granting our controlled attacker account Full Control over the object, further exploitation can be carried out. For detailed techniques and scenarios, please refer to GenericAll.
The following examples demonstrate exploitation on Windows and Linux environments.
Windows
To change the object's owner using AD Module
Example:
Now FullControl access can be granted to the controlled user
Example:
Linux
To change the object's owner using owneredit.py
Example:
Now FullControl access can be granted to the controlled user
Example:
Mitigation
Access Control Entries identified as dangerous should be removed by following the steps below.
1. Open Active Directory Users and Computers, and enable the Advanced Features option.
2. Double click the affected object and open Security tab.
3. In this tab, click Advanced button and open the risky Access Control Entry.
4. Remove the Modify Owner right.
5. Click OK and Apply buttons for saving changes.
Detection
Ownership changes modify the ntSecurityDescriptor of an Active Directory object. Monitor for these events:
5136
A directory service object was modified.
AttributeLDAPDisplayName (expected value ntSecurityDescriptor), ObjectDN
4662
An operation was performed on an object.
ObjectType, ObjectName, AccessMask
References
Last updated
Was this helpful?