active-directory-acl-abuse

Map Active Directory ACL configurations and BloodHound paths to plan privilege escalation.

1.6k|204|Updated Apr 7, 2026

Search Tags:#acl #kerberos #dcsync #ad #bloodhound #laps #gpo

Ready to run

npx skills add https://github.com/yaklang/hack-skills --skill active-directory-acl-abuse

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: active-directory-acl-abuse
Source: https://github.com/yaklang/hack-skills/tree/main/skills/active-directory-acl-abuse
Command: npx skills add https://github.com/yaklang/hack-skills --skill active-directory-acl-abuse

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This playbook helps security professionals identify and analyze misconfigured Active Directory ACLs to understand attack paths and readiness for privilege escalation.

Core Features & Use Cases

BloodHound enumeration guidance to discover shortest paths to Domain Admins.
ACE-type exploitation mapping (GenericAll, GenericWrite, WriteDACL, WriteOwner) with practical exploitation patterns.
DCSync, shadow credentials, LAPS reading, GPO abuse, and Kerberoasting use cases with example workflows.

Quick Start

Load this skill in a lab environment and run BloodHound queries to map ACL paths and plan privilege elevation.

Frequently Asked Questions about active-directory-acl-abuse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify Active Directory ACL abuse paths for privilege escalation?▼

Active Directory ACL abuse paths are identified by mapping misconfigured ACL configurations and applying BloodHound-guided enumeration to reveal shortest routes for privilege escalation via ACE types and DCSync rights.

What is the best way to exploit ACE types like GenericAll and WriteDACL in Windows domains?▼

Exploiting ACE types like GenericAll and WriteDACL involves mapping these specific Active Directory permissions to practical abuse patterns, enabling attackers to modify group memberships or grant elevated privileges across Windows domains.

Can I use BloodHound queries to plan DCSync and LAPS reading attacks?▼

BloodHound queries can plan DCSync and LAPS reading attacks by discovering shortest paths to Domain Admins and mapping the specific ACL configurations that grant the necessary permissions for these exploitation workflows.

How does GPO abuse work through misconfigured Active Directory ACLs?▼

GPO abuse works through misconfigured Active Directory ACLs by exploiting Write privileges on Group Policy Objects, allowing attackers to push malicious policies across Windows domains for widespread privilege escalation and compromise.

Do I need a lab environment to practice Active Directory ACL abuse reconnaissance?▼

A lab environment is needed to safely practice Active Directory ACL abuse reconnaissance, allowing you to load the skill, run BloodHound queries, map ACL paths, and plan privilege elevation without risking production domain infrastructure.