AD Permissions — Hub
BloodHound edges are not interchangeable — the target object (Domain, User, Group, Computer, OU, Certificate Template, CA) determines what you do. Each note links to the vault file with full commands.
Ctrl+F:
WriteDacl·GenericAll·DCSync·HasSession·ForceChangePassword·AD CS
External: Internal All The Things — Access Controls ACL/ACE
Collect paths → Bloodhound + Sharphound · decision tree → Credential Graph
📌 How to read a BloodHound ACL edge
- What right? (
WriteDacl,GenericAll,AddMember, …) - What object does the arrow point to? (Domain, user, group, computer, cert template, CA)
Open the matching note below → follow Execute links to bloodyAD, PowerView, Certipy & Certify, etc.
📌 Permission notes — interpret → execute
| Note | BloodHound right | First thought | Commands live in |
|---|---|---|---|
| WriteDacl | WriteDACL | Domain? → DCSync · User/group? → abuse that object | bloodyAD > add dcsync · secretsdump |
| GenericAll | GenericAll | Full control — reset pass / join group / RBCD by target | bloodyAD · PowerView |
| GenericWrite | GenericWrite | Shadow creds · RBCD · SPN · AS-REP | Shadow Credentials - pywhisker · Kerberoast |
| ForceChangePassword | ForceChangePassword | Reset target password → become user | bloodyAD > set password · Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE (different scenario) |
| AllExtendedRights | AllExtendedRights | Bundle — usually → ForceChangePassword on users | ForceChangePassword |
| WriteOwner | WriteOwner / Owns | Take ownership → grant GenericAll | bloodyAD > set owner → WriteDacl chain |
| AddMember | AddMember | Add self to privileged group | bloodyAD > add groupMember · LatMovement |
| AD CS Permissions | Write on template / ManageCA on CA | ESC4 / ESC7 cert abuse | ESC4 · ESC7 · AD CS ESC |
| DCSync | DCSync / GetChanges+GetChangesAll | Dump all domain hashes from DC | secretsdump · CrackMapExec - nxc --ntds · Mimikatz |
| HasSession | HasSession | User logged on host — steal creds if you have AdminTo | LSASS · PowerView Invoke-UserHunter · LatMovement |
📌 BloodHound edges — ACL vs relationship
| Type | Examples | Folder notes |
|---|---|---|
| DACL rights | WriteDacl, GenericAll, AddMember, … | Permission notes above |
| Relationships | HasSession, AdminTo, MemberOf | HasSession (+ AdminTo via LatMovement) |
| Granted rights | DCSync (result of ACL abuse or DA) | DCSync · grant via WriteDacl |
📌 Permission → tool quick map
| Need to… | Go to |
|---|---|
| Grant DCSync / modify ACLs | bloodyAD · PowerView |
| Dump hashes after DCSync | DCSync · Impacket secretsdump |
| Steal logged-on user creds | HasSession · LSASS |
| Shadow credentials | Shadow Credentials - pywhisker · Certipy & Certify |
| AD CS cert privesc | Certipy & Certify · AD CS ESC |
| Reset your must-change password | Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE · krb5-user |
| Graph / queries | Bloodhound + Sharphound |
📌 Standard escalation flow
BloodHound edge → [[AD Permissions]] note (interpret target)
→ linked exploit file (bloodyAD / PowerView / Certipy / Shadow Creds)
→ DCSync / DA shell / lateral ([[LatMovement]])