ACLs & Object Security

Security descriptors, DACL/SACL structure, ACE types, the access check algorithm, and how ACL analysis reveals backdoored service permissions and persistence paths

Security Descriptor

Every securable Windows object (file, registry key, process, service, named pipe, token, etc.) has a Security Descriptor. The Security Descriptor is a binary structure containing:

SECURITY_DESCRIPTOR
  +Revision         (1)
  +Sbz1             (reserved)
  +Control          (flags: DACL present, SACL present, DACL defaulted, etc.)
  +Owner SID        (who owns the object; owner can always change the DACL)
  +Group SID        (primary group; rarely used on Windows)
  +DACL             (Discretionary ACL: controls who can access the object)
  +SACL             (System ACL: controls what access gets audited)

Binary format:
  Absolute SD: pointers to SIDs and ACLs
  Self-relative SD: single buffer with all offsets relative to start
    (used for storage: files, registry)

DACL and ACE Types

The DACL is a list of Access Control Entries (ACEs). Each ACE specifies what a SID can or cannot do to the object. The kernel's access check scans the DACL ACEs in order and decides ALLOW or DENY.

Each ACE also carries inheritance flags that control whether the ACE propagates to child objects:

• OBJECT_INHERIT_ACE — inherit to child files
• CONTAINER_INHERIT_ACE — inherit to child directories/keys
• INHERIT_ONLY_ACE — don't apply to the object itself, only to children
• NO_PROPAGATE_INHERIT_ACE — don't propagate further than one level

SACL and Auditing

The System ACL (SACL) contains audit ACEs. These ACEs define what access attempts generate Security event log entries. Unlike the DACL, the SACL requires SeSecurityPrivilege to read or modify. A null SACL means no auditing; an empty SACL also means no auditing. SACL entries generate Event IDs 4656 (handle request), 4663 (object access), 4670 (permissions change).

Access Check Algorithm

When a process tries to open a securable object, the kernel runs the access check:

1. Collect the caller's token: user SID + all group SIDs + restricted SIDs (if applicable).
2. Compare the token's integrity level against the object's mandatory label (MIC check — Chapter 31). If MIC blocks the access, DENY immediately.
3. Check privileges: does the caller have a privilege that bypasses DACL? (SeBackupPrivilege for read, SeRestorePrivilege for write, SeTakeOwnershipPrivilege, etc.) If so, ALLOW.
4. Walk the DACL from the first ACE:

  DACL Walk (simplified):
    remaining_access = requested_access

    For each ACE in DACL:
      If ACE SID matches any SID in the token:
        If ACE type == DENY:
          If ACE.AccessMask overlaps remaining_access:
            DENY the entire request immediately
        If ACE type == ALLOW:
          remaining_access &= ~ACE.AccessMask  (clear the allowed bits)
          If remaining_access == 0:
            ALLOW the request (all requested bits satisfied)

    If all ACEs processed and remaining_access != 0:
      DENY (some access bits not explicitly allowed)
    If DACL is NULL: ALLOW everything
  

APIs

// Read the DACL of a service registry key and print ACEs
void PrintServiceAcl(const char *serviceName)
{
    char regPath[256];
    snprintf(regPath, 256, "SYSTEM\\CurrentControlSet\\Services\\%s", serviceName);

    HKEY hKey;
    RegOpenKeyExA(HKEY_LOCAL_MACHINE, regPath, 0, READ_CONTROL, &hKey);

    DWORD sdLen = 0;
    // First call to get size
    RegGetKeySecurity(hKey, DACL_SECURITY_INFORMATION, NULL, &sdLen);
    PSECURITY_DESCRIPTOR pSd = (PSECURITY_DESCRIPTOR)LocalAlloc(LPTR, sdLen);
    RegGetKeySecurity(hKey, DACL_SECURITY_INFORMATION, pSd, &sdLen);

    BOOL hasDacl, daclDefaulted;
    PACL pDacl = NULL;
    GetSecurityDescriptorDacl(pSd, &hasDacl, &pDacl, &daclDefaulted);

    if (!hasDacl || !pDacl) {
        printf("  [!] NULL or missing DACL — world-accessible!\n");
        goto cleanup;
    }

    for (WORD i = 0; i < pDacl->AceCount; i++) {
        void *pAce;
        GetAce(pDacl, i, &pAce);
        ACE_HEADER *hdr = (ACE_HEADER*)pAce;
        ACCESS_ALLOWED_ACE *aa = (ACCESS_ALLOWED_ACE*)pAce;

        char sidStr[256] = {}, name[256] = {}, dom[256] = {};
        DWORD nl = 256, dl = 256;
        SID_NAME_USE use;
        LPSTR strSid = NULL;
        ConvertSidToStringSidA(&aa->SidStart, &strSid);
        LookupAccountSidA(NULL, &aa->SidStart, name, &nl, dom, &dl, &use);

        printf("  ACE[%d]: Type=%s SID=%s (%s\\%s) Mask=0x%08X\n",
            i,
            hdr->AceType == ACCESS_ALLOWED_ACE_TYPE ? "ALLOW" :
            hdr->AceType == ACCESS_DENIED_ACE_TYPE  ? "DENY"  : "OTHER",
            strSid, dom, name, aa->Mask);
        LocalFree(strSid);
    }
cleanup:
    LocalFree(pSd);
    RegCloseKey(hKey);
}

Detection: Hunting Weak ACLs

# PowerShell: find services where non-admins have write access
# This is a classic local privilege escalation hunting script

Get-WmiObject -Class Win32_Service | ForEach-Object {
    $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($_.Name)"
    try {
        $acl = Get-Acl -Path $regPath -ErrorAction Stop
        foreach ($ace in $acl.Access) {
            $sid = $ace.IdentityReference
            # Flag write access for non-Admins/SYSTEM
            if ($ace.AccessControlType -eq 'Allow' -and
                $ace.RegistryRights -match 'FullControl|WriteKey|SetValue' -and
                $sid -notin @('NT AUTHORITY\SYSTEM','BUILTIN\Administrators','NT SERVICE\TrustedInstaller')) {
                Write-Host "[WEAK ACL] $($_.Name): $sid has $($ace.RegistryRights)"
            }
        }
    } catch {}
}

Q & A