🎯ACL Abuse Tactics
🎭 HTB Academy: Active Directory Enumeration & Attacks
📍 Overview
ACL Abuse Tactics represents the practical exploitation phase of Access Control List attacks in Active Directory environments. This module demonstrates how to execute a complete multi-step attack chain from initial user compromise to domain-level privilege escalation, utilizing misconfigured ACL permissions discovered during enumeration.
🔗 Attack Chain Overview
Complete Attack Path:
wley (compromised) → damundsen (password change) → Help Desk Level 1 (group membership) → Information Technology (nested groups) → adunn (GenericAll) → DCSync capabilitiesAttack Flow:
Initial Access:
wleyuser (hash cracked from Responder)Password Change: Force change
damundsenpassword using User-Force-Change-Password rightsGroup Membership: Add
damundsento "Help Desk Level 1" group using GenericWriteNested Privileges: Inherit "Information Technology" group membership
Target Control: Leverage GenericAll over
adunnuserFinal Goal: DCSync attack for domain compromise
🚀 Step 1: Authentication Setup
Creating PSCredential Objects
Initial wley Authentication:
Target Password Preparation:
Key Security Considerations
PowerShell Logging: Commands will be logged in PowerShell transcripts
Memory Exposure: SecureString objects may be retrievable from memory
Process Monitoring: Authentication attempts generate security events
Network Traffic: LDAP modifications are observable
🔐 Step 2: Password Manipulation Attack
Leveraging User-Force-Change-Password Rights
PowerView Password Change:
Expected Output:
Alternative Linux Approach
Attack Validation
👥 Step 3: Group Membership Manipulation
Preparing damundsen Credentials
Pre-Attack Group Enumeration
Current "Help Desk Level 1" Members:
Sample Output:
Group Membership Addition Attack
Expected Output:
Attack Validation
Alternative Linux Approach
🎯 Step 4: Targeted Kerberoasting Attack
Creating Fake SPN for adunn
Rationale:
adunnis an admin account that cannot be interruptedGenericAll rights allow SPN manipulation
Kerberoasting provides offline password cracking
More stealthy than direct password changes
SPN Creation:
Expected Output:
Kerberoasting Execution
Using Rubeus:
Expected Output:
Alternative Linux Approach
Hash Cracking with Hashcat
🧹 Step 5: Cleanup Procedures
Critical Cleanup Order
⚠️ IMPORTANT: Cleanup order matters! Remove SPN before removing group membership to maintain privileges.
1. Remove Fake SPN:
Expected Output:
2. Remove Group Membership:
Expected Output:
3. Verify Removal:
4. Password Reset Considerations:
Assessment Documentation Requirements
Critical Documentation:
All password changes made during assessment
Group membership modifications
SPN additions/removals
Timestamps of all modifications
Affected user accounts
Cleanup actions performed
Client Notification:
Include every modification in final assessment report
Provide evidence of cleanup procedures
Document any incomplete cleanup with explanations
Recommend client verification of all changes
🚨 Detection and Remediation
Event Monitoring
Key Event IDs:
Event ID 5136: Directory Service Object Modified
What it detects: ACL modifications, attribute changes
Location: Security Event Log on Domain Controllers
Critical for: Detecting ACL abuse attempts
Event ID 4728: Member Added to Security-Enabled Global Group
What it detects: Group membership changes
Location: Security Event Log on Domain Controllers
Critical for: Monitoring privileged group additions
Event ID 4732: Member Added to Security-Enabled Local Group
What it detects: Local group membership changes
Location: Security Event Log on member servers
Critical for: Local admin additions
Event Analysis Example
Viewing Event ID 5136:
SDDL Analysis:
Readable Output:
Filtering for Suspicious ACEs:
Advanced Detection Techniques
PowerShell Logging
Sysmon Configuration
Defensive Recommendations
1. ACL Auditing and Remediation
2. Group Membership Monitoring
3. Enable Advanced Audit Policy
4. Implement LAPS (Local Administrator Password Solution)
5. Regular BloodHound Analysis
🎯 HTB Academy Lab Solution
Lab Question: "Set a fake SPN for the adunn account, Kerberoast the user, and crack the hash using Hashcat. Submit the account's cleartext password as your answer."
Complete Lab Workflow:
Step 1: Connect to Target
Step 2: Setup Attack Environment
Step 3: Execute Kerberoasting Attack
Step 4: Crack Hash with Hashcat
Step 5: Cleanup
🔍 Complete HTB Academy Lab Execution
Target Details:
Target IP:
10.129.149.107RDP Credentials:
htb-student:Academy_student_AD!wley Password:
transporter@4(obtained from previous modules)
Step-by-Step Real Lab Commands:
1. RDP Connection:
2. Setup Attack Environment:
3. Password Change Attack:
Real Output:
4. Group Membership Manipulation:
Real Output:
5. Verify Group Membership:
Real Output:
6. Create Fake SPN:
Real Output:
7. Kerberoast adunn:
Real Output:
8. Extract and Crack Hash:
Real Hashcat Output:
🎯 Verified Answer: SyncMaster757
📋 Key Takeaways
Attack Chain Mastery
Multi-step Exploitation: Complex attack paths requiring multiple privilege escalations
ACL Dependency: Each step depends on previously discovered ACL permissions
Stealth Techniques: Using Kerberoasting instead of direct password changes for high-value targets
Cleanup Importance: Proper cleanup prevents detection and maintains professional standards
Technical Skills Developed
PowerView Mastery: Advanced PowerShell AD manipulation
Credential Management: PSCredential objects and secure string handling
Group Manipulation: Strategic group membership modifications
Kerberoasting: SPN manipulation and TGS ticket extraction
Hash Cracking: Offline password recovery techniques
Defensive Insights
Event Monitoring: Critical Event IDs for ACL abuse detection
SDDL Analysis: Converting security descriptors to human-readable format
Audit Policies: Proper logging configuration for detection
Regular Auditing: Automated ACL and group membership monitoring
Professional Considerations
Documentation: Every change must be documented for client
Cleanup Procedures: Critical for maintaining client trust
Impact Assessment: Understanding potential disruption of admin accounts
Communication: Coordinating with client for sensitive changes
🔑 This represents the practical culmination of ACL enumeration - from discovery to exploitation to cleanup - demonstrating complete adversarial simulation capabilities in enterprise Active Directory environments.
Last updated