AllExtendedRights — AD Permission Abuse
Ctrl+F:
AllExtendedRights·extended rights
AllExtendedRights grants all extended rights on the target object — a bundle of powerful operations, not a single action.
Owned User
│
AllExtendedRights
▼
Target ObjectYour first thought:
“Which extended right do I need on this object?” — then use the matching permission note.
📌 Common extended rights inside AllExtendedRights
| Extended right | BloodHound edge | Exploit doc |
|---|---|---|
| User-Force-Change-Password | ForceChangePassword | ForceChangePassword |
| Send-As (Exchange) | AllExtendedRights on mailbox | Send mail as victim — niche |
| User-Change-Password | Self-service change | Less useful for privesc |
| Replication (subset) | Sometimes overlaps DCSync paths | WriteDacl → DCSync |
On most OSCP boxes, AllExtendedRights on a user → treat as ForceChangePassword (reset password and become user).
📌 Target → action
| Target | Typical abuse |
|---|---|
| User | Reset password → ForceChangePassword |
| Computer | May allow LAPS read or other extended ops — check BloodHound edge label |
| Domain | Rare — enumerate specific extended rights in ACE details |
📌 Execute — password reset (most common)
Same commands as ForceChangePassword:
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' set password victim 'NewPassword123!'Set-DomainUserPassword -Identity victim -AccountPassword (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force)If you need more than password reset (SPN, shadow creds, group join), check whether you also have GenericWrite or GenericAll — AllExtendedRights alone is narrower.
📌 vs other rights
| Right | Scope |
|---|---|
| AllExtendedRights | Extended rights only (password reset, etc.) |
| GenericWrite | Most LDAP attributes |
| GenericAll | Everything including extended rights |
| WriteDacl | Modify ACL — grant yourself other rights |
📌 Quick cheat sheet
AllExtendedRights → User? → [[ForceChangePassword]] → bloodyAD set password
AllExtendedRights + need SPN/RBCD? → check for [[GenericWrite]] / [[GenericAll]] too