← Back to Academy

Academy Node

WriteDACL

WriteDACL allows modifying the target object's security descriptor.

Advanced100 XPBloodHound Edge

Why it matters

It can be abused to grant yourself stronger rights, including DCSync on the domain object.

How to identify it

  • BloodHound WriteDACL edge
  • PowerView ACL output

BloodHound indicators

  • WriteDACL

BloodyAD commands

bloodyAD --host 192.168.184.141 -d xutslabs.local -u USER -p PASS add genericAll TARGET USER

PowerView commands

Add-DomainObjectAcl -TargetIdentity TARGET -PrincipalIdentity USER -Rights All

Expected output

  • ACL modified
  • New edge appears after recollection

Success looks like

  • You grant yourself exploitable rights

Failure looks like

  • Protected object
  • Insufficient rights
  • Replication delay

Troubleshooting

  • Recollect BloodHound
  • Check AdminSDHolder
  • Use LDAPS if required

Common mistakes

  • Not confirming target object type
  • Trying DCSync against wrong object

Alternative attacks

  • WriteOwner
  • GenericAll

What to try next

  • Grant DCSync
  • GenericAll abuse
  • Reset password

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.