Possibility of ACE inheritence/Editing DACLs - Githubissues

aniqfakhrul / powerview.py

Just another Powerview alternative

MIT License

427 stars 47 forks source link

Possibility of ACE inheritence/Editing DACLs #66

Closed Thy-GoD closed 11 months ago

Thy-GoD commented 11 months ago

So I was trying to edit the DACL of a user with GenericAll access to an Organizational Unit, in order to do a similar attack mentioned in these resources:

https://github.com/fortra/impacket/pull/1291 and

The closest powerview command I could find was the Add-DomainObjectAcl command, but it would give an error.

I apologize for the censoring in advance.

I'm not sure if this is the correct command if I were to carry out this sort of attack, the target and principals are correct, and it does work on Impacket's DACLEdit.py script.

Any input would be appreciated, thanks.

aniqfakhrul commented 11 months ago

Thanks for input. We will look into this and give you an update.

Thy-GoD commented 11 months ago

Thanks alot, I'm loving this tool so far, so I apologize if I continue asking questions regarding it's use.

H0j3n commented 11 months ago

No worries, feels free to report any issues.

Can you verify if the issue still persists? @Thy-GoD

Before:

After:

Thy-GoD commented 11 months ago

Hey guys, I've verified that the fix works and the problem's solved.

Thanks alot for the help!