Academy Node
GenericAll
GenericAll is effectively full control over the target AD object.
Intermediate100 XPBloodHound Edge
Why it matters
It usually provides a direct abuse route if you understand the target type.
How to identify it
- BloodHound GenericAll edge.
- PowerView ACL review.
- BloodyAD object permissions.
BloodHound indicators
- GenericAll edge to User
- GenericAll edge to Group
- GenericAll edge to Computer
NetExec commands
nxc ldap 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --bloodhound --collection AllBloodyAD commands
bloodyAD --host 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' get object TARGETPowerView commands
Find-InterestingDomainAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match 'GenericAll'}Expected output
- BloodHound path with GenericAll edge.
Success looks like
- You reset password, add self to group, or configure RBCD depending on target.
Failure looks like
- Access denied due to wrong object or protected ACL behavior.
Troubleshooting
- Check object protection.
- Check effective permissions.
- Try alternate LDAP tooling.
Common mistakes
- Not checking AdminSDHolder-protected users.
- Resetting passwords when Shadow Credentials would be cleaner in a lab.
Alternative attacks
- GenericWrite
- WriteDACL
- Owner abuse
What to try next
- If user: reset password or Shadow Credentials.
- If group: add self.
- If computer: RBCD.
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
Resource-Based Constrained Delegation
RBCD lets a controlled machine account impersonate users to a target computer when msDS-AllowedToActOnBehalfOfOtherIdentity is writable.