Feature: WriteLogonScript ACL support

[ncha-syn]

Feature Description

Currently, the "scriptPath" attribute's ACEs are not collected.

Are you intending to implement this feature?

Yes

Current Behavior

There would be a new edge "WriteLogonScript".

Desired Behavior

It would extend bloodhound capabilities and support a new edge.

Use Case

This PR adds a missing edge to comprise users.

Implementation Suggestions

Additional Information

[martinsohn]

Hi @ncha-syn, thank you for the PRs!

It's a good idea. We discussed it internally and would love to see it implemented if there is a reliable abuse mechanism.

Do you have an example of such?

I found two blogs about it, but both fail to demonstrate an abuse mechanism as they require writing a script to NETLOGON, i.e., not viable:

• https://medium.com/@muneebnawaz3849/writescriptpath-abuse-in-active-directory-cb5945848a51
• https://happycamper84.medium.com/the-scriptpath-attribute-another-incredibly-arcane-windows-privilege-5bf4f3dcd8c4

The second also states:

Personally I had issues getting a logon script to run unless it was in NETLOGON. However given what Microsoft and Google say I would not take this as definitive that logon scripts will only run out of NETLOGON.