Grant rights
Last updated
Was this helpful?
Last updated
Was this helpful?
This abuse can be carried out when controlling an object that has WriteDacl over another object.
The attacker can write a new ACE to the target object’s DACL (Discretionary Access Control List). This can give the attacker full control of the target object.
Instead of giving full control, the same process can be applied to allow an object to by adding two ACEs with specific Extended Rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All). Giving full control leads to the same thing since GenericAll includes all ExtendedRights, hence the two extended rights needed for DCSync to work.
Story time, Exchange Servers used to have WriteDacl over domain objects, allowing attackers to conduct a attack where control would be gained over an Exchange Server which would then be used to grant an attacker-controlled object DCSync privileges to the domain.
From UNIX-like systems, this can be done with 's dacledit.py (Python).
At the time of writing, May 2nd 2022, the is still pending.
For a DCSync granting attack, instead of using dacledit, has the ability to operate that abuse with the --escalate-user option (see ).
To enable inheritance, the -inheritance switch can be added to the command. Then it is possible to find interesting targets with AdminCount=0in BloodHound for example, by looking at the object attributs.
