GenericWrite ACL not collected on OU

[sploutchy]

The ACL Processor collects GenericAll, WriteDACL and WriteOwner ACLs on all object types.

For GenericWrite and WriteProperty, it collects the ACLs only for User, Group and Computer (and to some extent GPOs):

SharpHoundCommon/src/CommonLib/Processors/ACLProcessor.cs

Lines 338 to 392 in a2cc6c1

	//GenericWrite encapsulates WriteProperty, so process them in tandem to avoid duplicate edges
	if (aceRights.HasFlag(ActiveDirectoryRights.GenericWrite) ||
	aceRights.HasFlag(ActiveDirectoryRights.WriteProperty))
	{
	if (objectType is Label.User or Label.Group or Label.Computer or Label.GPO)
	if (aceType is ACEGuids.AllGuid or "")
	yield return new ACE
	{
	PrincipalType = resolvedPrincipal.ObjectType,
	PrincipalSID = resolvedPrincipal.ObjectIdentifier,
	IsInherited = inherited,
	RightName = EdgeNames.GenericWrite
	};
	if (objectType == Label.User && aceType == ACEGuids.WriteSPN)
	yield return new ACE
	{
	PrincipalType = resolvedPrincipal.ObjectType,
	PrincipalSID = resolvedPrincipal.ObjectIdentifier,
	IsInherited = inherited,
	RightName = EdgeNames.WriteSPN
	};
	else if (objectType == Label.Computer && aceType == ACEGuids.WriteAllowedToAct)
	yield return new ACE
	{
	PrincipalType = resolvedPrincipal.ObjectType,
	PrincipalSID = resolvedPrincipal.ObjectIdentifier,
	IsInherited = inherited,
	RightName = EdgeNames.AddAllowedToAct
	};
	else if (objectType == Label.Computer && aceType == ACEGuids.UserAccountRestrictions && !resolvedPrincipal.ObjectIdentifier.EndsWith("-512"))
	yield return new ACE
	{
	PrincipalType = resolvedPrincipal.ObjectType,
	PrincipalSID = resolvedPrincipal.ObjectIdentifier,
	IsInherited = inherited,
	RightName = EdgeNames.WriteAccountRestrictions
	};
	else if (objectType == Label.Group && aceType == ACEGuids.WriteMember)
	yield return new ACE
	{
	PrincipalType = resolvedPrincipal.ObjectType,
	PrincipalSID = resolvedPrincipal.ObjectIdentifier,
	IsInherited = inherited,
	RightName = EdgeNames.AddMember
	};
	else if (objectType is Label.User or Label.Computer && aceType == ACEGuids.AddKeyPrincipal)
	yield return new ACE
	{
	PrincipalType = resolvedPrincipal.ObjectType,
	PrincipalSID = resolvedPrincipal.ObjectIdentifier,
	IsInherited = inherited,
	RightName = EdgeNames.AddKeyCredentialLink
	};
	}

I just stumbled upon a case where an Everyone has GenericWrite on an OU, this can be exploited as shown in the following articles:

• https://labs.withsecure.com/blog/ou-having-a-laugh/
• https://markgamache.blogspot.com/2020/07/exploiting-ad-gplink-for-good-or-evil.html

I think this edge should also be collected on OUs. What do you think?

Thanks a lot for your great work!

[hubert3]

Agree this should be collected on OUs as well if possible

[rvazarkar]

I think historically, we've resisted adding this edge because the exploitation of this primitive is very complex and relies on several factors that are hard to enumerate. Maybe its time we took another look at it, but exploitation is still very complex, relying on ability to add DNS records or new computers for example