Garfield

Garfield

Overview

Garfield is a hard-rated Windows Active Directory machine. We start with credentials for a low-privileged domain account, so there’s no initial foothold to find, it’s an assumed-breach setup.

With a writable SYSVOL share, we update the logon script and update a user’s scriptPath attribute to the script.

From there, BloodHound shows a chain of weak object permissions that let us move from one account to the next until we land on an account with rights over the domain’s Read-Only Domain Controller (RODC). We use those rights to get a foothold on the RODC, then abuse the way an RODC caches domain passwords to recover the Administrator credentials and reach Domain Admin.

References

• adsecurity