Abusing WriteDACL
As previously stated, all Active Directory objects have a DACL
and one object access right in particular,
grants permission to modify the DACL itself.
In this section, we’ll leverage this to compromise an account.
Before we start the attack, we’ll enumerate misconfigured user accounts
with Get-DomainUser and Get-ObjectAcl.
The output reveals that our current user has
WriteDACL access rights to the TestService2 user,
which allows us to add new access rights like GenericAll.
We can use the Add-DomainObjectAcl PowerView method,
to apply additional access rights such as GenericAll,
GenericWrite, or even DCSync,
if the targeted object is the domain object.
For example, let’s add the GenericAll access right,
to the TestService2 object.
Although the method is called Add-DomainObjectAcl,
it will actually modify the current ACE if an entry already exists.
After attempting to modify the DACL,
we’ll dump it again to verify that GenericAll was applied correctly.
We now have GenericAll access rights to TestService2.
Let’s proceed to change its password.
The password change was successful.
As demonstrated, the WriteDACL access right is just as powerful as GenericAll.