Abusing GenericAll
In our first case study, we’ll focus on the GenericAll access right,
which gives full control of the targeted object.
To begin, we first enumerate all domain users
that our current account has GenericAll rights to.
One approach is to gather all domain users with PowerView’s Get-DomainUser method
and pipe the output into Get-ObjectAcl.
This will enumerate all ACEs for all domain users.
Next, we can resolve the SID,
add it to the output, and finally filter on usernames that match our current user
as set in the UserDomain and Username environment variables.
The output reveals that our current user,
has the AccessAllowed AceType,
and the GenericAll access right,
on the TestService1 account.
This is likely a misconfiguration
since this is a non-default access right and is excessive.
Although the misconfigurations in this module are used for demonstration purposes
some applications (like Exchange or SharePoint)
require seemingly excessive access rights to their associated service accounts.
Regardless, the GenericAll access right
gives us full control over the TestService1 user,
which among other things,
allows us to change the password of the account
without knowledge of the old password.
Once we reset the password, we can log in to another computer with the account.
Let’s log in to appsrv01 to prove this.
We could also choose to create a process in the context of that user
to perform a pass-the-ticket attack
as we demonstrated in an earlier module.
Compromising an account with an allowed GenericAll access right is very simple.
We can also abuse the ForceChangePassword,
and AllExtendedRights,
access rights to change the password of a user account
in a similar way without supplying the old password.
So far, we have only dealt with user accounts,
but since everything in Active Directory is an object,
these concepts also apply to groups.
For example, we can enumerate all domain groups
that our current user has an explicit access rights to
by piping the output of Get-DomainGroup
into Get-ObjectAcl and filtering it,
in a process similar to the previous user account enumeration.
The output shows that we have GenericAll access rights on the TestGroup group.
Since GenericAll gives us full access to the group,
we can compromise the group by simply adding ourselves to it.
As with user accounts, we can also use the
AllExtendedRights and GenericWrite access rights in a similar way.
GenericAll is an extremely powerful access right
that can lead to very straightforward compromise.
In the next section,
we’ll cover another access right that we can leverage for compromise.