Academy Node
ForceChangePassword
ForceChangePassword lets you reset the target user's password without knowing the old one.
Intermediate100 XPBloodHound Edge
Why it matters
It can convert an ACL edge directly into valid credentials.
How to identify it
- BloodHound ForceChangePassword edge
BloodHound indicators
- ForceChangePassword
BloodyAD commands
bloodyAD --host 192.168.184.141 -d xutslabs.local -u USER -p PASS set password TARGET 'NewP@ssw0rd123!'PowerView commands
Set-DomainUserPassword -Identity TARGET -AccountPassword (ConvertTo-SecureString 'NewP@ssw0rd123!' -AsPlainText -Force)Expected output
- Password reset succeeds
Success looks like
- New password validates
Failure looks like
- Access denied
- Protected user
- Password policy failure
Troubleshooting
- Use complex password
- Check protected users
Common mistakes
- Resetting high-value user without checking lockout/policy
- Forgetting password complexity
Alternative attacks
- Shadow Credentials
- Targeted Kerberoast
What to try next
- Validate creds
- Check WinRM/SMB/LDAP
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.