DACL

Every Active Directory object carries a discretionary access control list (DACL): a list of access-control entries (ACEs) saying which principals may read or modify it. Administrators delegate these rights liberally and almost never audit them, so AD is full of ACEs that let an ordinary principal modify a privileged one. DACL work is turning a write over an object into control of it, and BloodHound exists largely to find these edges and chain them (A can write B, B is admin of C) into a path to Domain Admin.

The complete edge map#

Each abusable right, the attribute or control-access right behind it, and where the technique is documented:

The right only matters for what it lets you do, so the table is the fast path: find the edge in BloodHound, jump to the technique.

Choosing the quietest conversion#

Several edges reach the same goal with very different footprints, which is the practical decision once you hold a write:

• Shadow credentials (where PKINIT is available) and targeted Kerberoasting are non-destructive: they do not change the victim's password or lock anyone out, so prefer them over a password reset when the account is in use.
• A password reset is loud and disruptive (the legitimate user loses access), so keep it for computer or stale accounts, or when nothing quieter is available.
• RBCD and adding replication rights leave a durable configuration change; adding yourself to a group is trivially visible in membership. Weigh persistence value against detectability.

Pages#

• ACL enumeration: finding the abusable ACEs with BloodHound and from Linux.
• BloodHound: collecting and graphing the ACL and privilege attack paths across the domain.
• Password reset: ForceChangePassword / GenericAll to take an account over.
• Group membership: AddMember / AddSelf to join a privileged group.
• Targeted Kerberoasting: WriteSPN to make a target roastable.
• Ownership and ACL rewrite: WriteOwner / WriteDacl, and the Owner Rights limits that now constrain them.
• AdminSDHolder: DACL persistence through SDProp.

Once an edge lands you in a built-in privileged group, membership itself is the escalation:

• Privileged groups: what membership of DnsAdmins, Backup/Server/Print Operators, and others grants.
• DnsAdmins: a DLL loaded into the DNS service as SYSTEM.
• Backup Operators: SeBackupPrivilege reads NTDS.dit.
• Server Operators: reconfigure a service to run as SYSTEM.

Tools#

• BloodHound: transitive ACL path analysis and edge identification.
• Impacket (dacledit.py, owneredit.py): read/write ACEs and change ownership from Linux.
• bloodyAD: set owner, grant rights, reset passwords, add key credentials and group members from Linux.
• NetExec (nxc): -M daclread to read ACEs, -M maq for the machine-account quota, and --ntds once a DCSync grant lands, over LDAP/SMB.
• PowerView (Add-DomainObjectAcl, Set-DomainObjectOwner): on-host ACE and ownership edits.

References#

• SpecterOps: An ACE Up the Sleeve, and the BloodHound edge reference
• The Hacker Recipes: DACL abuse