active-directory-acl-abuse

Map Active Directory ACL relationships and execute ACE-specific privilege escalation paths.

2|Updated May 15, 2026

Search Tags:#dcsync #bloodhound #cypher queries #active directory #laps #gpo abuse #acl abuse

Ready to run

npx skills add https://github.com/lNwNl/Methodos --skill active-directory-acl-abuse-lnwnl

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: active-directory-acl-abuse
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/active-directory-acl-abuse
Command: npx skills add https://github.com/lNwNl/Methodos --skill active-directory-acl-abuse-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps security testers identify and exploit misconfigured Active Directory permissions (ACL abuse) to escalate access and achieve high-impact outcomes.

Core Features & Use Cases

BloodHound-guided path discovery: Collect and query relationship graphs to locate shortest paths from owned principals to privileged targets.
ACE-specific exploitation playbooks: Translate dangerous permissions such as GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, DCSync-related rights, LAPS reading, and GPO write access into concrete attack actions.
Multi-step chain analysis: Use purpose-built BloodHound Cypher queries and attack-path patterns to select efficient escalation routes.

Quick Start

Tell the AI to use BloodHound to find shortest paths from a compromised user to Domain Admins and then outline the exact ACL misconfigurations to exploit based on those paths.

Frequently Asked Questions about active-directory-acl-abuse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I exploit Active Directory ACL misconfigurations using BloodHound?▼

BloodHound ACL abuse identifies misconfigured permissions like GenericAll, WriteDACL, and DCSync by mapping relationship graphs and shortest paths from compromised principals to privileged targets. It translates these dangerous ACEs into concrete attack actions and operational steps to escalate access and achieve high-impact outcomes.

What Cypher queries help find Active Directory ACL attack paths?▼

Purpose-built BloodHound Cypher queries locate shortest paths from owned principals to high-value targets like Domain Admins. These queries map ACL relationships and attack-path patterns to select efficient escalation routes based on specific ACE misconfigurations such as LAPS reading or GPO write access.

What Active Directory ACE techniques can I use for privilege escalation?▼

Active Directory privilege escalation techniques include exploiting GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, DCSync rights, LAPS reading, and GPO write access. The Skill maps these dangerous permissions to specific attack playbooks for executing concrete operational steps.

Can I use BloodHound to plan multi-step ACL abuse chains against Domain Admins?▼

Yes, BloodHound supports multi-step chain analysis by applying purpose-built Cypher queries and attack-path patterns to select efficient escalation routes. This enables chain-based decision making for reaching high-value targets like Domain Admins from a compromised user position.

When do I need to investigate LAPS or GPO write access for AD privilege escalation?▼

Investigate LAPS reading or GPO write access when BloodHound enumeration reveals these specific dangerous permissions along the shortest path to privileged targets. The Skill evaluates these ACE misconfigurations and outlines exact exploitation steps based on the discovered attack paths.