Admin Groups Indirect Control

[Jelle-Dirk]

Possibly related to #185 ?

I've got service accounts that are part of the Domain Admins group
Lower tiered accounts used to have access to these Service accounts, but they're now in a different OU with inheritance disabled.

Effective access tab, only shows read permissions.

Pingcastle still somehow sees a path up.
Could it be because pingcastle is being ran with an account that is a member of the Built-IN/Administrators group?

[JoeDibley]

Hey there,
We do have some funkiness here which is not explained well in the product and we haven't had time to resolve yet.

This still shows because indirect takeover paths exist such as GPLinks when you have access to the OU. Here are some links to the Bloodhound Docs that contain information on this:

• https://bloodhound.specterops.io/resources/edges/write-gp-link
• https://bloodhound.specterops.io/resources/edges/gp-link

[Jelle-Dirk]

The analyses view, sees a way from lower tiered admin user -> their security group -> gen_right_all -> service account with domain admin

The service account is in a OU with inheritance disabled, Block inheritance in the GPO view is now also set.

The analyses view, lists some GPOs separately as having access to the service account, even after I blocked inheritance and set a specific deny apply for the service account. Though not linking back to the aforementioned lower tiered admin accounts, with the implicit deny, can't figure out why that too isn't going away though.

gplinks is something I saw suggested before, so I had second look today too, but still not able to find it.
Being able to see these hidden links would be very helpful, I will keep an eye out for future updates that's for sure.

Thank you for effort, and very quick response!