search

BloodHoundAD / SharpHound2

The Old BloodHound C# Ingestor (Deprecated)
509 stars 113 forks source link

Added GenericWrite edge for GPOs #79

Open pkb1s opened 5 years ago

pkb1s commented 5 years ago

SharpHound currently does not detect Edit Settings permissions on a GPO. However, this level of access can be used as part of an attack path.

image

The current version of SharpHound generates the following:

before_genericwrite

After the changes the graph includes the 2 more users:

after_genericwrite

I hope this helps.

Thanks

andyrobbins commented 4 years ago

Hey @pkb1s, thanks a lot for this PR! Looks very cool and of course your recent blog post about this was very interesting as well. Here's my request before we merge this in: can you create and post a video showing the attack in action, from beginning to end? Showing the specific permissions on the GPO, setting up your dummy domain controller, serving an evil schedule task, and showing that evil scheduled task running?

pkb1s commented 4 years ago

Hi @andyrobbins, apologies for the delay. I have included the video you requested below: https://www.youtube.com/watch?v=3QSRTUGEzEA

andyrobbins commented 4 years ago

Excellent, thank you for making that vid, @pkb1s. Very straight forward. We are going to test a few things on our side to confirm but you should expect to see this edge start showing up in the next release.