search

🔑ACL Enumeration

hashtag
📋 Overview

Access Control List (ACL) enumeration is a critical phase in Active Directory penetration testing that reveals privilege escalation paths through object permissions and rights. Understanding how to systematically enumerate and analyze ACLs enables attackers to discover complex attack chains from low-privilege users to domain administrative access. This section covers both manual PowerView techniques and automated BloodHound analysis for comprehensive ACL assessment.

hashtag
🎯 Strategic Context

hashtag
🔧 ACL Fundamentals

  • Access Control Entries (ACEs): Individual permission entries within ACLs

  • Security Identifiers (SIDs): Unique identifiers for security principals

  • Extended Rights: Special permissions beyond standard read/write operations

  • Object Types: Users, groups, computers, and domain objects with ACLs

  • Attack Chains: Multi-hop privilege escalation through ACL exploitation

hashtag
⚡ ACL Attack Scenarios

  • Targeted Enumeration: Starting from controlled user accounts

  • Group Membership Manipulation: Adding users to privileged groups

  • Password Reset Rights: Force changing other users' passwords

  • GenericAll/GenericWrite: Comprehensive control over target objects

  • DCSync Rights: Domain replication permissions for credential extraction

hashtag
🔧 PowerView ACL Enumeration

hashtag
📊 Basic ACL Discovery with Find-InterestingDomainAcl

Example Output (Truncated):

⚠️ Problem with Basic Enumeration:

  • Information Overload: Returns massive amounts of data

  • Time Consumption: Extremely inefficient during assessments

  • Analysis Paralysis: Difficult to identify actionable attack paths

  • Context Missing: Lacks focus on controlled users/assets

hashtag
🎯 Targeted ACL Enumeration Strategy

hashtag
📍 Step 1: Convert Username to SID

hashtag
🔍 Step 2: Basic Object ACL Search (Without GUID Resolution)

Example Raw Output:

hashtag
🔍 Step 3: Manual GUID to Rights Mapping

GUID Resolution Output:

hashtag
⚡ Step 4: Automated GUID Resolution with -ResolveGUIDs

Human-Readable Output:

hashtag
🔄 Alternative Native PowerShell Methods

hashtag
📋 Method 1: Using Get-Acl and Get-ADUser

Native PowerShell Output:

⚠️ Performance Note:

  • Much Slower: Takes significantly longer than PowerView

  • Resource Intensive: High CPU/memory usage in large environments

  • Less Efficient: Requires additional GUID resolution steps

  • Useful Backup: When PowerView is blocked or unavailable

hashtag
🔗 Multi-Hop Attack Path Discovery

hashtag
📊 Attack Chain Example: wley → damundsen → Help Desk Level 1 → Information Technology → adunn → DCSync

hashtag
Step 1: Initial User (wley) Analysis

hashtag
Step 2: Second Hop Analysis (damundsen)

damundsen Rights Output:

💡 Key Finding: damundsen has GenericWrite over "Help Desk Level 1" group!

hashtag
Step 3: Group Nesting Analysis

Group Nesting Output:

💡 Discovery: Help Desk Level 1 is nested in "Information Technology" group!

hashtag
Step 4: Information Technology Group Rights

Information Technology Rights:

💡 Key Finding: Information Technology group has GenericAll over adunn user!

hashtag
Step 5: Final Target Analysis (adunn)

adunn Rights (DCSync Discovery):

💡 JACKPOT: adunn has DS-Replication-Get-Changes and DS-Replication-Get-Changes-In-Filtered-Set → DCSync Attack!

hashtag
🩸 BloodHound ACL Visualization

hashtag
📊 Attack Path Discovery with BloodHound

hashtag
Step 1: Data Collection

hashtag
Step 2: Visual Analysis

  1. Set Starting Node: Search for and select wley@INLANEFREIGHT.LOCAL

  2. Node Info Tab: Scroll to "Outbound Control Rights"

  3. First Degree Object Control: Shows direct rights (ForceChangePassword → damundsen)

  4. Transitive Object Control: Shows full attack path (16 total objects)

hashtag
Step 3: Interactive Attack Path

hashtag
🔍 BloodHound Interface Features

hashtag
Right-Click Help Menus:

  • Attack Information: Detailed exploitation techniques

  • Tool Commands: Specific commands for each attack

  • OPSEC Considerations: Stealth and detection avoidance

  • External References: Links to additional resources

hashtag
Pre-Built Queries:

  • Find Shortest Paths to Domain Admins

  • Find Principals with DCSync Rights

  • Users with Foreign Domain Group Membership

  • Computers where Domain Users are Local Admin

hashtag
🎯 HTB Academy Lab Solutions

hashtag
📝 Lab Questions & Solutions

hashtag
🔍 Question 1: "What is the rights GUID for User-Force-Change-Password?"

Solution:

✅ Answer: 00299570-246d-11d0-a768-00aa006e0529

hashtag
🚩 Question 2: "What flag can we use with PowerView to show us the ObjectAceType in a human-readable format during our enumeration?"

Solution:

✅ Answer: -ResolveGUIDs

hashtag
🔑 Question 3: "What privileges does the user damundsen have over the Help Desk Level 1 group?"

Solution:

✅ Answer: GenericWrite

hashtag
🎯 Question 4: "Using the skills learned in this section, enumerate the ActiveDirectoryRights that the user forend has over the user dpayne (Dagmar Payne)."

Complete Lab Workflow:

Solution Process:

Actual Lab Output:

✅ Answer: GenericAll

hashtag
🏆 Question 5: "What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)"

Complete Solution Process (using same RDP session):

Actual Lab Output:

Key Observation: The first entry shows ObjectAceType : Self-Membership

✅ Answer: Self-Membership

hashtag
📋 HTB Academy Lab Summary

All Verified Answers:

  1. Rights GUID for User-Force-Change-Password: 00299570-246d-11d0-a768-00aa006e0529

  2. PowerView flag for human-readable format: -ResolveGUIDs

  3. damundsen privileges over Help Desk Level 1: GenericWrite

  4. forend ActiveDirectoryRights over dpayne: GenericAll

  5. forend ObjectAceType over GPO Management: Self-Membership

Key Lab Details:

  • RDP Credentials: htb-student:Academy_student_AD!

  • Target IP: 10.129.149.107 (example)

  • Tools Directory: C:\Tools\

  • PowerView Module: Import with Import-Module .\PowerView.ps1

  • Core Technique: Convert-NameToSid + Get-DomainObjectACL

Attack Path Discovered:

hashtag
🔧 Advanced ACL Enumeration Techniques

hashtag
🎯 Targeted Rights Enumeration

hashtag
🔍 Object-Specific ACL Analysis

hashtag
📊 ACL Statistics and Analysis

hashtag
🛠️ Common ACL Attack Patterns

hashtag
🔑 Password Reset Rights

hashtag
👥 Group Membership Manipulation

hashtag
🎯 GenericAll Exploitation

hashtag
🔄 DCSync Rights Discovery

hashtag
🎓 Key Learning Objectives

hashtag
✅ PowerView Mastery

  • Targeted Enumeration: Start from controlled users, not broad sweeps

  • SID Conversion: Convert-NameToSid for efficient searches

  • GUID Resolution: Always use -ResolveGUIDs for readable output

  • Object Filtering: Use SecurityIdentifier filtering for precise results

hashtag
🎯 Attack Path Discovery

  • Multi-Hop Thinking: Each compromised user opens new attack vectors

  • Group Nesting: Understand transitive group membership privileges

  • Rights Escalation: Map from basic user to domain admin systematically

  • Documentation: Track each hop in the attack chain

hashtag
📊 BloodHound Integration

  • Visual Confirmation: Use BloodHound to verify manual enumeration

  • Path Optimization: Find shortest routes to high-value targets

  • Query Mastery: Leverage pre-built and custom Cypher queries

  • Help Resources: Utilize right-click help for attack techniques

hashtag
⚠️ Operational Considerations

  • Time Management: Avoid getting lost in massive ACL outputs

  • Target Prioritization: Focus on privileged groups and admin accounts

  • Alternative Methods: Have backup techniques when tools are blocked

  • Performance Impact: Large environment enumeration can be resource-intensive

hashtag
⚡ Quick Reference Commands

hashtag
🔧 Essential ACL Enumeration Workflow

hashtag
📊 Common ACL Rights Reference

Right Type

Capability

Attack Vector

User-Force-Change-Password

Reset user passwords

Password reset attack

GenericAll

Full control over object

Complete compromise

GenericWrite

Modify object properties

Group membership, attributes

Self-Membership

Add self to group

Privilege escalation

DS-Replication-Get-Changes

Domain replication

DCSync attack

WriteProperty

Modify specific properties

Targeted attribute changes

hashtag
🔑 Key Takeaways

hashtag
✅ ACL Enumeration Best Practices

  • Start Targeted: Begin with controlled users, not domain-wide sweeps

  • Use -ResolveGUIDs: Always prefer human-readable output

  • Think Multi-Hop: Each user compromise opens new attack vectors

  • Document Paths: Track the full attack chain for reporting

hashtag
🎯 Strategic Enumeration

  • User → Group → User Chains: Most common privilege escalation pattern

  • Group Nesting: Critical for transitive privilege inheritance

  • High-Value Targets: Domain Admins, Exchange admins, service accounts

  • DCSync Rights: Ultimate goal for credential extraction

hashtag
⚠️ Operational Insights

  • Time Boxing: Don't get lost in massive ACL outputs

  • Tool Redundancy: Have PowerShell alternatives when PowerView fails

  • BloodHound Confirmation: Visual validation of discovered paths

  • Performance Awareness: Large enumeration can impact target systems

hashtag
🚀 Attack Chain Examples

  1. wley → [ForceChangePassword] → damundsen → [GenericWrite] → Help Desk Level 1 → [MemberOf] → Information Technology → [GenericAll] → adunn → [DCSync] → Domain Compromise

  2. Low-privilege User → [Self-Membership] → Privileged Group → [Group Rights] → High-value Target → [Administrative Access] → Domain Control

ACL enumeration transforms scattered AD permissions into clear attack paths, revealing how seemingly innocuous user rights can escalate to complete domain compromise through systematic privilege chaining.

PreviousKerberoasting from WindowsNextACL Abuse Tactics

Last updated