WriteOwner Exploit
Refer to: https://www.youtube.com/watch?v=ob9SgtFm6_g&t=1431s
What is the WriteOwner Permission For?
Active Directory objects such as users and groups are securable objects and DACL/ACEs define who can read/modify those objects (i.e change account name, reset password, etc). The WriteOwner permission can be abused by an attacker to change the object owner to an attacker controlled user and take over the object
Scenario:
You have managed to compromise an account belonging to Tom. Running Bloodhound identified that there were was no direct access from Tom's account to Domain Admins. Checking Outband Object Control reveled an attack path from Tom to the Backup Admin group through Claire.
Attack Path
Tom has
WriteOwner
permissions over ClaireClaire has
GenericWrite
permissions over the groupBACKUP_ADMINS
BACKUP_ADMINS
sounds interesting :)
In order to easily take advantage of the WriteOwner
and GenericWrite
permissions, we’ll use PowerView
, which is part of the PowerSploit collection.
Success. You can now login as Claire using the new password: qwer1234QWER!@#$
Last updated