search

BloodHoundAD / SharpHound2

The Old BloodHound C# Ingestor (Deprecated)
509 stars 113 forks source link

No computer object acls #57

Open JoernHe opened 5 years ago

JoernHe commented 5 years ago

Hi, first of all thank you for this amazing project. One point: If a user has e.g. ResetPassword rights on an domain controller object, wouldn't this be a privilege escalation vulnerability because of the dc sync privilege of a domain controller object? The same with an exchange server object, because this object can manipulate ACEs of the domain root. At the moment you just care about computer object acls if they have LAPS installed. Or am i wrong? Thank you!

rvazarkar commented 5 years ago

As far as I'm aware, if you reset the password of a computer account, it becomes de-synced from active directory, and can cause several issues. I'll have to test again, but that's my understanding of the issue

JoernHe commented 5 years ago

You are right. But you can authenticate as a domain controller to another domain controller after the reset and perform a dc sync (and get the history of the DC object password). After that you could reset it to the old password. The same with an exchange computer object.

JoernHe commented 5 years ago

I just saw that issue #230 in bloodhound is almost the same.

rvazarkar commented 5 years ago

Can you design a Proof of Concept of this attack? What risks are involved?

HarmJ0y commented 5 years ago

"you could reset it to the old password" - as you only have the hash, does that mean you would need to use the mimikatz lsadump::setntlm or dcshadow approach to plant the previous hash into the AD database? My gut feeling is that this approach would be fairly disruptive to a normal environment with a lot of things that could go wrong operationally.