OU Having a Laugh: Abusing Organizational Unit DACLs in Active Directory
Petros Koutrompis analyzes newly added BloodHound edges targeting Active Directory Organizational Units (OUs), demonstrating subtle ACL takeover paths.
Summary
The Power of Active Directory Attack Path Graphing
BloodHound has transformed enterprise assessments by mapping complex graph relationships and hidden discretionary access control lists (DACLs) across Active Directory.
Analyzing Organizational Unit (OU) Permission Structures
Petros Koutrompis dissects how generic write permissions and object creation rights over OUs can be weaponized to seize control of child objects.
Chaining OU DACL Abuse into Domain Escalation
The speaker demonstrates real-world attack paths where low-privilege users manipulate OU permissions to move computer accounts, force GPO updates, and compromise administrators.
Defensive Auditing and DACL Hygiene
The author provides remediation queries and auditing scripts to identify and remove dangerous inherited permissions on Active Directory containers.
Related talks
Main Stage·45 min
Andy Robbins · Rohan Vazarkar · Will Schroeder
Andy Robbins, Rohan Vazarkar, and Will Schroeder introduce BloodHound, leveraging graph theory to reveal unintended hidden privilege escalation paths in Active Directory.
Main Stage·43 min
Quentin Roland · Wilfried Bécard
Demonstrates how red teams can weaponize Active Directory Group Policy Objects (GPOs) into a stealthy, native command-and-control infrastructure.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.