search

CravateRouge / bloodyAD

BloodyAD is an Active Directory Privilege Escalation Framework
MIT License
1.12k stars 112 forks source link

module "setGenericAll" remove permissions does not work #27

Closed trietend closed 1 year ago

trietend commented 1 year ago

The "setGenericAll" module with flag "enable" set to "False" does not work for me. After adding the permissions them with the module it is not possible to remove them.

https://github.com/CravateRouge/bloodyAD/blob/68408821b4f0ab280d7b45e2af621ee5268d4082/bloodyAD/utils.py#L266

"ace_haspriv" is always "false" here.

Therefore the remove is never reached. https://github.com/CravateRouge/bloodyAD/blob/68408821b4f0ab280d7b45e2af621ee5268d4082/bloodyAD/utils.py#L282

Also this path is not taken, if the permissions are added twice. https://github.com/CravateRouge/bloodyAD/blob/68408821b4f0ab280d7b45e2af621ee5268d4082/bloodyAD/utils.py#L272

CravateRouge commented 1 year ago

Try with v0.1.8 I changed a lot of things regarding security descriptor modifications in db27fa9

trietend commented 1 year ago

tested it on friday :D works now, thanks a lot!

CravateRouge commented 1 year ago

Haha yes it can change very quickly

Great news! If you notice anything else don't hesitate to raise an issue or to make a suggestion.