MachineAccountQuota
Last updated
Was this helpful?
Last updated
Was this helpful?
MachineAccountQuota (MAQ) is a domain level attribute that by default permits unprivileged users to attach up to 10 computers to an Active Directory (AD) domain ()
There are multiple ways attackers can leverage that power.
, to domain controllers using LDAPS, and take advantage of authenticated sessions to create a domain computer account. This account can then be used as a foothold on the AD domain to operate authenticated recon (i.e. for example)
Create a computer account and use it for when leveraging owned accounts with sufficient permissions (i.e. ACEs like GenericAll, GenericWrite or WriteProperty) against a target machine
Create a computer account and use it for a attack when leveraging owned accounts with sufficient permissions (i.e. the SeEnableDelegationPrivilege user right)
Profit from special rights that members of the Domain Computers group could inherit
Profit from special rights that could automatically be applied to new domain computers based on their account name
The module (for (Python)) can be used to check the value of the MachineAccountQuota attribute:
Alternatively, it can be done manually with the Python library ():
With (Python):
With (Python):
With ldapsearch (openldap (C)):
addcomputer.py also has an option -computer-group for adding a group to which the account will be added. Because if omitted, the group CN=Computers will be used by default.
Certipy also offers option to set the UPN (-upn), SAM account name (-sam), SPNS (-spns) while creating the computer.
In order to run the following commands and tools as other users, testers can check the part.
The following command, using the 's cmdlets Get-ADDomain and Get-ADObject, will help testers make sure the controlled domain user can create computer accounts (the MachineAccountQuota domain-level attribute needs to be set higher than 0. It is set to 10 by default).
FuzzSecurity's project is an alternative in C# (.NET assembly) to perform some AD post-compromise operations. Among the possible actions, the MAQ attribute can be requested ().
The script (Python) can be used to create a computer account, using the credentials of a domain user the the MachineAccountQuota domain-level attribute is set higher than 0 (10 by default).
Testers can also use (Python) instead with the --add-computer option, like
When using 's addcomputer script for the creation of a computer account, the "SAMR" method is used by default (instead of the LDAPS one). At the time of writing (10th of December, 2021), the SAMR method creates the account without SPNs. In this case, they could be added later on with (Python). By default, computer accounts have the following SPNs set:
With (Python):
With (Python):
With (Python):
The module (PowerShell) can be used to create a domain computer account.
An alternative is to use FuzzSecurity's (C#, .NET assembly) project to create a new password account with a random password, disable the account, or delete it (with elevated privileges):
