feat: add GenericWrite and WriteGPLink for Domain

SpecterOps · May 13, 2024 · eb3af9a · eb3af9a
1 parent 95ca1de
commit eb3af9a
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/CommonLib/Processors/ACLProcessor.cs b/src/CommonLib/Processors/ACLProcessor.cs
@@ -380,6 +380,7 @@ or Label.Group
                         or Label.Computer 
                         or Label.GPO 
                         or Label.OU 
+                        or Label.Domain
                         or Label.CertTemplate 
                         or Label.RootCA 
                         or Label.EnterpriseCA 
@@ -419,7 +420,7 @@ or Label.NTAuthStore
                             IsInherited = inherited,
                             RightName = EdgeNames.WriteAccountRestrictions
                         };
-                    else if (objectType == Label.OU && aceType == ACEGuids.WriteGPLink)
+                    else if (objectType is Label.OU or Label.Domain && aceType == ACEGuids.WriteGPLink)
                         yield return new ACE
                         {
                             PrincipalType = resolvedPrincipal.ObjectType,
@@ -601,4 +602,4 @@ public IEnumerable<ACE> ProcessGMSAReaders(byte[] groupMSAMembership, string obj
             }
         }
     }
-}
+}