Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

SKILL: AD ACL Abuse — Expert Attack Playbook AI LOAD INSTRUCTION : Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns. 0. RELATED ROUTING Before going deep, consider loading: [active directory kerberos attacks](../active directory kerberos attacks/SKILL.md) for Kerberos attacks often chained with ACL abuse [active directory certificate services](../active directory certificate services/SKILL.md) for certificate based attacks after ACL exploitation [ntlm relay coercion](../ntlm relay coercion/SKILL.md) for relay attacks that can set ACLs (LDAP relay) [windows lateral movement](../windows lateral movement/SKILL.md) after gaining elevated AD access Advanced Reference Also load [BLOODHOUND PATHS.md](./BLOODHOUND PATHS.md) when you need: Common BloodHound attack paths with Cypher queries Custom Neo4j queries for finding complex chains Data collection and ingestion tips 1. BLOODHOUND ENUMERATION Data Collection Key BloodHound Queries (Built in) "Find all Domain Admins" "Shortest Paths to Domain Admins from Owned Principals" "Find Principals with DCSync Rights" "Shortest Paths to Unconstrained Delegation Systems" "Find computers where Domain Users are Local Admin" 2. DANGEROUS ACE TYPES ACE Effect on Users Effect on Groups Effect on Computers GenericAll Change password, set SPN, modify attributes Add members RBCD, LAPS read, all attributes GenericWrite Set SPN, modify attributes, shadow creds Add members RBCD, shadow credentials WriteDACL Grant yourself any permission Same Same WriteOwner Take ownership → then WriteDACL Same Same ForceChangePassword Reset password without knowing old N/A N/A AddMember N/A Add self/others to group N/A AllExtendedRights Force change password, read LAPS N/A Read LAPS, BitLocker keys ReadLAPSPassword N/A N/A Read local admin password WriteSPN Set SPN → targeted kerberoast N/A N/A 3. ACE SPECIFIC EXPLOITATION GenericAll on User GenericAll / GenericWrite on Computer WriteDACL WriteOwner ForceChangePassword AddMember to Group 4. DCSYNC ATTACK Prerequisites The principal needs both of these replication rights on the domain object: DS Replication Get Changes (GUID: 1131f6aa 9c07 11d1 f79f 00c04fc2dcd2 ) DS Replication Get Changes All (GUID: 1131f6ad 9c07 11d1 f79f 00c04fc2dcd2 ) Execution Who Has DCSync by Default? Domain Admins Enterprise Admins Domain Controllers group BUILTIN\Administrators (on domain object) 5. SHADOW CREDENTIALS Attack Flow Write msDS KeyCredentialLink on target → generate certificate → authenticate via PKINIT. Cleanup : Remove the added key credential to avoid detection. 6. LAPS PASSWORD READING 7. GPO ABUSE Identify Writable GPOs Exploit via SharpGPOAbuse 8. ACL ATTACK DECISION TREE

active-directory-acl-abuse