DΛΣMӨП

Catalog WADComs

WAD · Tool

bloodyAD

9 techniques Linux · ActiveDirectory · WindowsWADComs GPL-3.0

bloodyAD-Wite-Properties

Enumeration Linux

BloodyAD can be used to set, write and delete properties of objects in AD. Given a user:pass, you can use bloodyAD to which objects and what properties of those objects are writeable to the user:pass given. Thus if you use -u john -p john, this command will show you what objects and properties can john write to Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Password: password123 

bloodyAD --host 10.10.10.1 -d test.local -u john -p password123 -d test.local get writable --detail
Native
Enumeration
Requires
Username, Password

bloodyAD-AddComputer

NEW
ExecutionPrivilege Escalation LinuxActiveDirectoryWindows

bloodyAD's `add computer` action creates a new machine account in the domain over LDAP. Any authenticated user can create up to ms-DS-MachineAccountQuota (default 10) computer accounts, so this is a reliable way to obtain an attacker-controlled principal for RBCD, shadow-credential, or S4U abuse chains. The created computer account has a known password you control. Check the MachineAccountQuota before use; a value of 0 blocks this. Command Reference: Target DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123

# Create a computer account (returns the new SAM account name and password)
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add computer EVILPC 'Password123!'
Native
Exploitation, PrivEsc
Requires
Username, Password
Services
LDAP

bloodyAD-AddGenericAll

NEW
Privilege EscalationPersistenceExecution LinuxActiveDirectoryWindows

bloodyAD's `add genericAll` action writes a new ACE granting a trustee full control (GenericAll) over a target object's DACL via LDAP. Use it to escalate a lesser right (WriteDacl / WriteOwner) into full control over a user, group, or computer, or to establish a durable ACL backdoor for persistence. Once you hold GenericAll you can reset passwords, set shadow credentials, or configure RBCD on the target. Command Reference: Target DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123 Target object: victim Granted principal: john

# Grant john GenericAll over the victim object
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add genericAll victim john
Native
PrivEsc, Persistence, Exploitation
Requires
Username, Password
Services
LDAP

bloodyAD-AddGroupMember

NEW
Privilege EscalationExecution LinuxActiveDirectoryWindows

bloodyAD's `add groupMember` action writes the `member` attribute of a group over LDAP, adding an arbitrary principal (typically yourself) to it. Use it when BloodHound shows you hold GenericAll, GenericWrite, WriteOwner, or Self/AddMember over a privileged group such as an admin or Remote Management group. Adding your account to a high-value group is a direct privilege-escalation primitive; remove yourself afterward to reduce footprint. Command Reference: Target DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123 Target group: Domain Admins

# Add yourself (john) to a group you can write to
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add groupMember 'Domain Admins' john
Native
PrivEsc, Exploitation
Requires
Username, Password
Services
LDAP

bloodyAD-AddRBCD

NEW
Privilege EscalationLateral MovementExecution LinuxActiveDirectoryWindows

bloodyAD's `add rbcd` action writes the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute of a target computer over LDAP, configuring Resource-Based Constrained Delegation so that a controlled service account may impersonate any user to that machine. Combine with an attacker-controlled computer account (see bloodyAD add computer) and Impacket getST -impersonate to obtain a service ticket as a local admin. Requires GenericWrite / GenericAll / WriteProperty over the target computer object. Command Reference: Target DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123 Target computer: DC01$ Controlled service: EVILPC$

# Allow EVILPC$ to act on behalf of others against DC01$
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add rbcd 'DC01$' 'EVILPC$'
Native
PrivEsc, Lateral Movement, Exploitation
Requires
Username, Password
Services
LDAP

bloodyAD-DontReqPreauth

NEW
Credential AccessExecution LinuxActiveDirectoryWindows

bloodyAD's `add uac` action with the `-f DONT_REQ_PREAUTH` flag sets the DONT_REQ_PREAUTH bit in a target user's userAccountControl over LDAP, disabling Kerberos pre-authentication. This is a targeted AS-REP roasting primitive: once the flag is set you can request an AS-REP for the account and crack it offline. Requires GenericWrite / write access to the target's userAccountControl; remove the flag afterward to clean up. Command Reference: Target DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123 Victim user: victim

# Enable targeted AS-REP roasting on the victim
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add uac victim -f DONT_REQ_PREAUTH
Native
Credential Access, Exploitation
Requires
Username, Password
Services
LDAP, Kerberos

bloodyAD-SetOwner

NEW
Privilege EscalationExecutionPersistence LinuxActiveDirectoryWindows

bloodyAD's `set owner` action rewrites the owner field in a target object's security descriptor over LDAP. The object owner has implicit WriteDacl, so seizing ownership of a user, group, or computer lets you subsequently grant yourself GenericAll (see bloodyAD add genericAll) and fully control it. Use it when BloodHound reports WriteOwner over a principal. Pair it with a follow-up DACL write to complete the takeover. Command Reference: Target DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123 Target object: victim New owner: john

# Take ownership of the victim object, then grant yourself full control
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' set owner victim john
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add genericAll victim john
Native
PrivEsc, Exploitation, Persistence
Requires
Username, Password
Services
LDAP

bloodyAD-SetPassword

NEW
ExecutionPrivilege Escalation LinuxActiveDirectoryWindows

bloodyAD's `set password` action performs a targeted password reset on a user or computer object over LDAP(S). It is the exploitation step when you hold GenericAll, User-Force-Change-Password, or WriteAll over a victim principal discovered in BloodHound. Resetting a service account or privileged user password grants immediate takeover, at the cost of locking out the legitimate user, so it is loud. Requires LDAPS (or LDAP with channel binding) on modern DCs for the password write. Command Reference: Target DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123 Victim user: victim

# Force-reset the password of a user you have write rights over
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' set password victim 'NewPassword123!'
Native
Exploitation, PrivEsc
Requires
Username, Password
Services
LDAP

bloodyAD-ShadowCredentials

NEW
Privilege EscalationPersistenceCredential Access LinuxActiveDirectoryWindows

bloodyAD's `add shadowCredentials` action appends an attacker-generated key credential to the target's `msDS-KeyCredentialLink` attribute (the Shadow Credentials / Key Trust technique). Requiring only GenericWrite over the victim and an ADCS-enabled PKINIT-capable environment, it lets you authenticate as the target via a certificate and recover its NT hash without changing the account's password, making it far stealthier than a password reset. bloodyAD prints the PFX and follow-up PKINIT command. Command Reference: Target DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123 Victim account: DC01$

# Add a shadow credential (KeyCredentialLink) to the victim
bloodyAD --host 10.10.10.1 -d test.local -u john -p 'password123' add shadowCredentials 'DC01$'
Native
PrivEsc, Persistence, Credential Access
Requires
Username, Password
Services
LDAP, ADCS