acl-abuse

# ACL Abuse Active Directory permissions are a graph. A single misconfigured Access Control Entry (ACE), say a low-priv user with `GenericAll` over a group, `WriteDacl` over a computer, or `WriteOwner` over an OU, is a directed edge you can walk from where you are toward Domain Admin. This skill turns those edges into concrete commands with **bloodyAD** and **impacket**, after **BloodHound CE** (Apache-2.0, genuinely open source) has drawn the path. **Find the paths first (BloodHound CE).** Collect with a standard collector, import into BloodHound CE, and look at the outbound control edges from your owned principal: `GenericAll`, `GenericWrite`, `WriteDacl`, `Owns`/`WriteOwner`, `AddMember`, `ForceChangePassword`, `AllExtendedRights`, and `DCSync`. Pre-built queries like "Shortest paths from Owned principals" and "Find principals with DCSync rights" hand you the chain. Collect edges with a standard collector, for example: ``` nxc ldap 10.0.0.10 -u user -p 'Password123' --bloodhound --collection All --dns-server 10.0.0.10 ``` or run `rusthound-ce` / SharpHound CE and import the ZIP into BloodHound CE. --- ## GenericAll **MITRE ATT&CK:** T1222 (Permission Modification) / T1098 (Account Manipulation) **What it is.** Full control over the target object. What you do with it depends on the target type: - **Over a user:** reset their password (ForceChangePassword) or set an SPN and Kerberoast them (targeted roasting), or set `DONT_REQ_PREAUTH` and AS-REP roast. - **Over a gro...