Designing Active Directory DACL Backdoors
Using Active Directory DACL misconfigurations to achieve domain compromise and persistence.
Summary
Active Directory Security
Active Directory object discretionary access control lists (DACLs) represent an untapped offensive landscape, often overlooked by attackers and defenders. Control relationships between AD objects align with "attackers think in graphs" philosophy.
Control Edges
DACL analysis exposes previously unseen control edges, dramatically expanding paths to complete domain compromise. Attackers can identify numerous paths through careful DACL analysis.
Persistence Opportunity
DACL misconfigurations provide covert persistence deployment opportunities. Distinguishing intentional configurations from accidents is difficult, providing plausible deniability.
Forensic Analysis
Active Directory DACL backdoors have minimal forensic footprint and maximum plausible deniability. Understanding DACL-based control relationships and covert persistence techniques is critical for both offensive and defensive security.
Related talks
Main Track 1·40 min
Marina Simakov, Igal Gofman
Lesser-known persistence mechanisms using Kerberos delegation and advanced authentication abuse.
Black Hat·47 min
Engineers explore architecture and security mechanisms for An ACE Up the Sleeve: Designing Active Directory DACL Backdoors.
Blue Team Village·37 min
Siyu Zhu
Due to internal environment of Windows domains is always too tolerant, and enterprises are more concerned about border defenses than internal security, the penetration behavior based on Windows Active Directory has be...