Impacket-dacledit

Impacket's dacledit.py reads and modifies the DACL of an Active Directory object over LDAP. With `-action write -rights DCSync` against the domain naming context it grants a principal the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights, enabling that principal to perform a DCSync and dump every domain hash. This is a classic ACL-based domain-privilege-escalation and persistence primitive; it requires WriteDacl over the domain object. Back up the DACL with `-action read` first so you can restore it. Command Reference: DC IP: 10.10.10.1 Domain: test.local Username: john Password: password123 Granted principal: john

# Grant john DCSync rights on the domain object
dacledit.py -action 'write' -rights 'DCSync' -principal 'john' -target-dn 'DC=test,DC=local' -dc-ip 10.10.10.1 'test.local/john:password123'

Native

PrivEsc, Persistence, Credential Access

Requires

Username, Password

Services

LDAP

Refs

github.com/fortra/impacket

www.thehacker.recipes/ad/movement/dacl/grant-rights

book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse