Introduction

This guide outlines a practical playbook for identifying and exploiting weak Access Control Lists (ACLs) in Active Directory environments, along with steps to remediate any configuration issues and maintain security posture. The purpose of this guide is to provide both offensive and defensive teams with an understanding of ACL abuse and its mitigation.

Prerequisites

• User Credentials: Valid credentials with sufficient privileges to change passwords and add members to AD groups.
• PowerView, Rubeus, or Similar Tools: For executing actions such as changing passwords, enumerating groups, Kerberoasting, and performing ACL analysis.
• Secure Environment: A lab or approved testing environment for any planned exploit attempts.

Attack Chain Overview

1. Acquire Target Credentials
   • Obtain the hash of an account with the necessary privileges (for example, using Responder or cracking NTLMv2 hashes offline).
2. Password Changes / Group Membership
   • Abuse ACL rights (GenericWrite, GenericAll) to change a target user’s password or add a compromised account to a high-value group.
3. Nested Group Escalation
   • Take advantage of nested group memberships to elevate privileges further, potentially leading to Domain Admin access.
4. Kerberoasting
   • Set a fake Service Principal Name (SPN) on an admin or service account, request the service ticket, and crack the resulting hash offline if feasible.

Detailed Steps

Step 1: Change Target User’s Password

1. Create PSCredential objects for the compromised user.
2. Use tools like PowerView’s Set-DomainUserPassword to force a password reset on a chosen account.
3. Confirm the password change was successful by authenticating as the target user.

Step 2: Modify Group Membership

1. Create another PSCredential object using the newly accessed target user’s credentials.
2. Add the user to a group that grants membership inheritance or direct privilege escalation (e.g., Help Desk Level 1 or Information Technology) via Add-DomainGroupMember.
3. Verify that the user was successfully added to the group.

Step 3: Abuse Nested Group Rights

1. Inherit elevated permissions from nested group membership.
2. Leverage GenericAll or GenericWrite to escalate to high-privileged accounts (e.g., by resetting passwords or setting SPNs on admin users).

Step 4: Kerberoasting (Optional Escalation)

1. Assign a fake SPN to an account with high privileges using Set-DomainObject.
2. Request a Kerberos ticket with Rubeus or similar.
3. Save the ticket hash and attempt to crack offline.
4. Use any recovered credentials to perform advanced attacks like a DC synchronization (DCSync).

Cleanup

• Remove Fake SPNs: Clear the servicePrincipalName attribute from the compromised account.
• Restore Group Membership: Remove the compromised user from any privileged groups added during testing.
• Revert Password Changes: Restore original passwords or let the legitimate user update them.

Detection

• Audit and Remove Risky ACLs: Regularly check permissions in Active Directory, focusing on critical paths.
• Monitor Group Membership: Track memberships for groups with high privileges, alerting the security team to unusual additions.
• Advanced Security Audit Policy: Enable relevant event IDs (e.g., 5136) to detect modifications to objects in real time.
• Use Tools for Monitoring: Employ solutions like BloodHound to visualise and detect dangerous ACL paths.

Remediation Strategies

When ACL abuse is detected or suspected:

1. Immediate Actions
   • Isolate affected systems.
   • Revoke compromised credentials.
   • Remove unauthorised group memberships.
2. ACL Clean-up
   • Review and remove dangerous ACLs.
   • Implement least-privilege access model.
3. Password Resets
   • Force password changes for affected accounts.
   • Consider implementing multi-factor authentication.
4. System Hardening
   • Patch vulnerabilities
   • Strengthen password policies.

Best Practices

Proactively protect against ACL abuse with these best practices:

1. Regular AD Audits
   • Conduct periodic reviews of ACLs and group memberships.
   • Use tools like BloodHound to identify potential attack paths.
2. Principle of Least Privilege
   • Grant minimal necessary permissions to users and groups
   • Regularly review and revoke unnecessary access.
3. Separation of Duties
   • Implement role-based access control.
   • Avoid concentration of privileges in single accounts
4. Employee Training
   • Educate IT staff on ACL management and security implications.
   • Train users on security awareness and password hygiene
5. Continuous Monitoring
   • Implement real-time alerting for critical AD changes.
   • Regularly review and analyse AD logs.

Additional Resources

• Microsoft Documentation: Active Directory Security Best Practices
• MITRE ATT&CK: Active Directory
• SANS Institute: Active Directory Security
• BloodHound: Active Directory Security Tool
• PowerView: AD Enumeration and Exploitation Tool

By following this playbook, organisations can significantly improve their ability to prevent, detect, and respond to ACL abuse tactics in their Active Directory environments.