fox-it / invoke-aclpwn Goto Github PK

License: MIT License

PowerShell 100.00%

invoke-aclpwn's Introduction

Invoke-ACLpwn

Invoke-ACLpwn is a tool that automates the discovery and pwnage of ACLs in Active Directory that are unsafe configured.

For background information, read the release blog: https://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/

Invoke-ACLpwn is designed to run with integrated credentials as well as with specified network credentials. The script works by creating an export of all ACLs in the domain with SharpHound as well as the group membership of the user account that the tool is running under. If the user does not already have writeDACL permissions on the domain object, the tool will enumerate all ACEs of the ACL of the domain. Every identity in an ACE has an ACL of its own, which is added to the enumeration queue. If the identity is a group and the group has members, every group member is added to the enumeration queue as well.

It may take some time to calculate and parse every ACL, but could end up with a "chain" that leads to domain administrative privilges in the target domain.

Dependencies and installation

No installation is needed, however, in order to run Invoke-ACLpwn, a few depedencies must be met:

.NET 3.5 or later
sharphound.exe
If you want to run DCsync, you need mimikatz.exe as well.

Usage

Parameters:

    Required parameters:        
        SharpHoundLocation: location of sharphound.exe    

    Optional parameters:
        Domain            : FQDN of the target domain
        Username          : Username to authenticate with
        Password          : Password to authenticate with
        WhatIf            : Displays only the action the script intends to do. No exploitation.
                            Access as well as potential access will increase if the user account is added
                            to security groups, so the result of this switch may look incomplete.
        NoSecCleanup      : By default, the user will be removed from the ACL and the groups that were added during runtime when the script is finished. 
                            Setting this switch will leave that in tact.
        NoDCSync          : Will not run DCSync after all necessary steps have been taken
        userAccountToPwn  : User account to retrieve NTLM hash of. Only single user accounts supported now. Defaults to krbtgt account.
        logToFile         : Switch to write console output to file with the same name as script.
        mimiKatzLocation  : location of mimikatz.exe

Please note that specifying the mimikatz location is required unless the -NoDCSync switch is specified.

Example usage:

    ./Invoke-ACL.ps1 -SharpHoundLocation .\sharphound.exe -NoDCSync
    ./Invoke-ACL.ps1 -SharpHoundLocation .\sharphound.exe -mimiKatzLocation .\mimikatz.exe
    ./Invoke-ACL.ps1 -SharpHoundLocation .\sharphound.exe -mimiKatzLocation .\mimikatz.exe -userAccountToPwn 'Administrator'
    ./Invoke-ACL.ps1 -SharpHoundLocation .\sharphound.exe -mimiKatzLocation .\mimikatz.exe -LogToFile
    ./Invoke-ACL.ps1 -SharpHoundLocation .\sharphound.exe -mimiKatzLocation .\mimikatz.exe -NoSecCleanup
    ./Invoke-ACL.ps1 -SharpHoundLocation .\sharphound.exe -mimiKatzLocation .\mimikatz.exe -Username 'testuser' -Domain 'xenoflux.local' -Password 'Welcome01!'

About restoring ACLs and groupmemberships

If the -NoSecCleanup switch is not specified, the script will remove any permission that was set by the script as well as group memberships.

invoke-aclpwn's People

Contributors

Stargazers

Watchers

Forkers

peterg75 gavz hacktest kernullist a-min3 minkione gdraperi fuckup1337 rajivraj jack51706 riviera12345 shantanu561993 lexus89 ykankaya jamesit rich-roth 00derp threezerobravoteam johnjohnsp1 m00zh33 cephurs raystyle slooppe modulexcite topotam dipsec 0patch sasqwatch tailoredaccessteam jumbo-wjb forensic65x badbiddy attackgithub fzxcp3 balaasif6789 mrpentest netredo dskho imulmul atropineal get-get-get-get avi8892 ilbaroni rahmiy robrod14 mygit2014 w4fz5uck5 askyeye zer0codex hamm0nz pixelza bcp-infosec-repo surfslow startagain2016 pbssubhash marciopocebon l1ves dannymas funreason roxas-tan nosorry cb520 htoochonaung reverse-ex mrdoz bigbrobro tai-rex carbeneai inosec2 jermainlaforce d0ryy sys41x4 rezaduty gl4ssesbo1 foxhaunt 30579096 ououover khatcode red-spect3r thecryinggame amr-hamza techris45 tecsinapse-omni cmndcntrlcyber offsoc

invoke-aclpwn's Issues

No ACL input available error

I am receiving the following error below.

Not sure if its related but I am running it from a non-domain member system.

I specified the domain, username and password and it successfully bound to AD.

....
[] Getting schema classes...
[] Found 4729 schema classes
[] Getting extended rights from schema...
[] Found 142 extended rights
[*] Running SharpHound v2.0.0...
Get-SharpHoundACL : [Get-SharpHoundACL] No ACL input available.
At \github\Invoke-ACLPwn\Invoke-ACLPwn.ps1:1724 char:17

... InputPath = Get-SharpHoundACL -sharpHoundLocation $sharpHoundLocation ...
```
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
- FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-SharpHoundACL

Json files larger than 2Mb can't be parsed

Problem

The new functionality allowing the use of Bloodhound 2.0 Json output to be parsed fails silently if sharphound.exe produces Json files larger than 2Mb. ConvertFrom-Json has a hardcoded 2Mb input limit.

Possible Solution

replace the Json parse line 1489:
$tmp = ConvertFrom-Json $content -ErrorAction SilentlyContinue
with:

[void][System.Reflection.Assembly]::LoadWithPartialName("System.Web.Extensions")        
$jsonserial= New-Object -TypeName System.Web.Script.Serialization.JavaScriptSerializer 
$jsonserial.MaxJsonLength  = 67108864 #64Mb
$tmp = $jsonserial.DeserializeObject($content)

SharpHound Version 2.0 uses JSON as output format

This renders Invoke-ACLPwn useless in its current behavior when used in conjunction with an recent version of SharpHound

User not Found Exception

I Get The Following Exception in the parsing process.

[] Found 4882 ACLs
[] Parsing ACL. This might take a while...
[Get-DistinguishedNameForObject] User not found.
In C:\Invoke-ACLPwn-master\Invoke-ACLPwn-master\Invoke-ACLPwn.ps1:144 Zeichen:9

    throw '[Get-DistinguishedNameForObject] User not found.'

```
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : OperationStopped: ([Get-Distinguis...User not found.:String) [], RuntimeException
- FullyQualifiedErrorId : [Get-DistinguishedNameForObject] User not found.

Some ideas, how to fix this?

Cannot Call a Method

I am getting the following error even though it completes.

Given its not finding any chains, is this error something I can ignore or is it causing the script not to find any chains?

You cannot call a method on a null-valued expression.
At \Invoke-ACLPwn.ps1:1754 char:60

... ere-Object {$_.PrincipalName.ToString().ToLower() -like "$($g.NTAccou ...
```
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : InvalidOperation: (:) [], RuntimeException
- FullyQualifiedErrorId : InvokeMethodOnNull

You cannot call a method on a null-valued expression.
At \Invoke-ACLPwn.ps1:1754 char:60

... ere-Object {$_.PrincipalName.ToString().ToLower() -like "$($g.NTAccou ...
```
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : InvalidOperation: (:) [], RuntimeException
- FullyQualifiedErrorId : InvokeMethodOnNull

You cannot call a method on a null-valued expression.
At \Invoke-ACLPwn.ps1:1754 char:60

... ere-Object {$_.PrincipalName.ToString().ToLower() -like "$($g.NTAccou ...
```
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : InvalidOperation: (:) [], RuntimeException
- FullyQualifiedErrorId : InvokeMethodOnNull

[] Parsing ACL. This might take a while...
[] No chain found :(

Support for multi-domain forest

Running this tool with a user in the root domain of the forest works as expected. I have experienced the following failures:

Specifying a user in a child domain
setting the -domain param to a child domain with a child domain user
Error:

[Get-AttrForADObject] User not found.
At B:\Invoke-ACLPwn.ps1:109 char:9
+         throw '[Get-AttrForADObject] User not found.'
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: ([Get-AttrForADObject] User not found.:String) [], RuntimeException
    + FullyQualifiedErrorId : [Get-AttrForADObject] User not found.

fox-it / invoke-aclpwn Goto Github PK

invoke-aclpwn's Introduction

Invoke-ACLpwn

Dependencies and installation

Usage

About restoring ACLs and groupmemberships

invoke-aclpwn's People

Contributors

Stargazers

Watchers

Forkers

invoke-aclpwn's Issues

Problem

Possible Solution

Recommend Projects

Recommend Topics

Recommend Org