Academy Node
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
Intermediate100 XPBloodHound Edge
Why it matters
Depending on the target type, it can lead to Shadow Credentials, targeted Kerberoast, RBCD, group abuse, or GPO abuse.
How to identify it
- BloodHound edge: GenericWrite.
- Check target object type: user, computer, group, or GPO.
BloodHound indicators
- GenericWrite edge to User
- GenericWrite edge to Computer
- GenericWrite edge to Group
- GenericWrite edge to GPO
NetExec commands
nxc ldap 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' --bloodhound --collection AllBloodyAD commands
bloodyAD --host 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123' get object TARGETPowerView commands
Find-InterestingDomainAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match 'GenericWrite'}Expected output
- BloodHound shows GenericWrite path.
Success looks like
- You map target type to the right abuse path.
Failure looks like
- You try the wrong abuse for the object type.
Troubleshooting
- Confirm object type.
- Check if LDAPS is required.
- Check account write scope.
Common mistakes
- Treating all GenericWrite edges the same.
- Ignoring whether target is user, computer, group, or GPO.
Alternative attacks
- GenericAll
- WriteDACL
- AddSelf
What to try next
- User: Shadow Credentials or targeted Kerberoast.
- Computer: RBCD.
- Group: add self.
- GPO: GPO abuse.
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericAll
GenericAll is effectively full control over the target AD object.
Resource-Based Constrained Delegation
RBCD lets a controlled machine account impersonate users to a target computer when msDS-AllowedToActOnBehalfOfOtherIdentity is writable.