ACL Abuse and Shadow Credential
Case 1
Enumeration
Bloodhound
# DC FQDN should be defined in DNS server or host file.
cme ldap $RHOST -u library -p library --bloodhound -ns $RHOST -c all
Amelia.Griffth (1) is a member of legacy group (2), which has WriteDACL (3) to GPO ADM Account (4). The GPO ADM has GenericAll (5) to Default Domain policy GPO (6). The Privilege Escalation step should be:
Change WriteDACL to GenericAll to Amelia.Griffiths to abuse the GPO ADM account.
Create a Shadow account for GPO ADM account for your backdoor access (or just change the password of GPO ADM account).
Create a new task in the Default Domain policy GPO with the shadow account credential or new password changed.
Execution
Case 2
Preparation
Enumeration
LDAP
SMB
Bloodhound
Exploitation - ACL Abuse and Shadow Credential
Get a Bloodhound result below. The m.lovegod owns the Network Audit group, which has GenericWrite on the winrm_user user.
To get access to the machine, I’ll first I’ll need to give m.lovegod write access on the Network Audit group. Then I can add m.lovegod to the group. Finally, I can use those permissions to create a shadow credential for the winrm_user account to access to the machine via evil_winrm.
Update the ownership of the user to add a 'write permission'.
Add the full control of Group to the user.
Add the user to the group.
Create a Shadow Credential.
Last updated