Exploit misconfigured Active Directory ACLs for privilege escalation.
npx skills add https://github.com/blacklanternsecurity/red-run --skill acl-abuse
Please help me install this Agent Skill. Skill: acl-abuse Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/acl-abuse Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill acl-abuse
This Skill helps penetration testers identify and exploit misconfigured Access Control Lists (ACLs) in Active Directory environments to gain elevated privileges.
GenericAll rights on a user object via BloodHound, use this Skill to deploy Shadow Credentials, obtain a Kerberos ticket, and gain administrative access to a target system.Use the acl-abuse skill to find all user objects you have write access to.
High-intent search queries and answers about installing and using this skill.
Exploit Active Directory ACL misconfigurations by using tools like bloodyAD to execute techniques such as Shadow Credentials via msDS-KeyCredentialLink or ForceChangePassword when you have GenericAll rights on a target user object.
Yes, you can use pywhisker and Impacket to manipulate the msDS-KeyCredentialLink attribute for shadow credentials attacks, allowing you to obtain a Kerberos ticket and gain elevated access to target systems.
Enumerate exploitable write permissions by discovering users, groups, and computers where you have rights like GenericWrite, WriteDACL, or WriteOwner, then use this Skill to execute privilege escalation methods such as targeted Kerberoasting via SPN manipulation.
Yes, AdminSDHolder persistence is supported, allowing you to maintain elevated privileges by abusing misconfigured Access Control Lists to push malicious permissions out to protected groups and accounts.
Yes, you need valid domain credentials and identified ACL misconfigurations to leverage tools like bloodyAD, Certipy, and dacledit.py for executing WriteDACL or WriteOwner privilege escalation attacks.
Targeted Kerberoasting via SPN manipulation requires GenericWrite permissions on the target account to modify the servicePrincipalName attribute, and depends on tools like Impacket to request and extract service tickets for offline cracking.
AcczdySimulate Active Directory attacks and generate a structured JSON risk report.
YukiIto1999Enumerate Kerberoastable SPN accounts and collect TGS ticket hashes for offline cracking.
infantesromeroadrianExecute Active Directory attacks and credential access techniques with Impacket, CrackMapExec, and Certipy.
yaklangMap Active Directory ACL configurations and BloodHound paths to plan privilege escalation.