Object permissions (ACLs) and dangerous rights
You read an AD object’s security descriptor (owner, DACL, ACEs), get to know the SDDL format and the SD flags control, turn SIDs into names, find the admin password reset right given to the help desk and the dangerous right quietly given to an employee in this lab, check the DCSync rights and report the path to becoming an admin. The hidden right is different in every lab.
Level 201 · 50 min
You cleaned up group memberships and fixed delegation settings. But in AD power comes one more way: object permissions. Every user, group and OU has its own permission list, and giving a user the right to write a group’s member list is the same as making them a member: they can add themselves.
Analogy: a building’s door list. Besides "Ahmet may enter", it also says who may change the list itself. Someone who can change the list adds themselves whenever they like. In AD this list is the DACL and each line an ACE; all of it sits in the object’s nTSecurityDescriptor attribute in binary form.
To read the binary data, Kali has the lmos-acl tool: it turns the security descriptor into a readable table and turns SIDs into names. It only reads, it changes nothing. About 30 seconds after the lab starts, this lab’s own changes are in place.
What you will do in this lesson
- Read an OU’s permissions
- The same permissions on one line: SDDL
- The raw form: nTSecurityDescriptor and the SD flags
- From SID to name
- Who can use the right?
- Scan the privileged objects
- DCSync rights
- Record the hidden right
- The attack path report
- Short quiz
Skills you will earn
- Reading an AD object’s permissions (DACL, ACEs)
- Reading permissions in SDDL form
- Requesting nTSecurityDescriptor with the SD flags control
- Finding whom a SID belongs to
- Tracing an attack path from permissions to admin
- Finding dangerous rights on privileged objects
- Auditing DCSync (replication) rights
- Writing audit findings into a report
← Delegation risks · Active Directory security: auditing and hardening · Windows event IDs that matter for AD →
Start for free