> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/active-directory/acl-security-descriptors-and-permissions/vulnerable-acl-identification.md).
# Identifying Vulnerable ACLs
Active Directory security notes for Identifying Vulnerable ACLs, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps.
To begin the analysis, you can filter the ACLs of a sensitive group, for example the domain administrators group.
List of vulnerable ACEs
**ForceChangePassword**: Provides the ability to change the target user's password without knowing their current password. Can be abused with `Set-DomainUserPassword`.
**AddMembers**: Provides the ability to add arbitrary users, groups or computers to the target group. Can be abused with `Add-DomainGroupMember`.
**GenericAll**: gives full control over the object. This includes, for example, the ability to add other users to a group, change a user's password without knowing their current password, or save an SPN on a user object. Can be abused with `Set-DomainUserPassword` or `Add-DomainGroupMember`.
**GenericWrite**: gives the ability to modify any unprotected attribute of the target object. For example, modify the `scriptPath` attribute of a target user so that that user runs the specified commands or executables the next time they log in. Can be abused with `Set-DomainObject`.
**WriteOwner**: gives the ability to modify the owner of the target object. Once the owner of the object has been changed to a user controlled by the attacker, the attacker can manipulate the object according to the permissions he then gives himself. Can be abused with `Set-DomainObjectOwner`.
**WriteDACL**: gives the ability to write a new ACE in the DACL of the target object. For example, an attacker can add a new ACE in the DACL of the target object in order to grant themselves full control over this object. Can be abused with `Add-NewADObjectAccessControlEntry`.
**AllExtendedRights**: Provides the ability to perform all actions associated with Active Directory extended rights on the target object. For example, adding users to a group or forcing a target user's password to change. Can be abused with `Set-DomainUserPassword` or `Add-DomainGroupMember`.
{% code overflow="wrap" %}
```powershell
Get-DomainObjectAcl -Identity "Domain Admins"
```
{% endcode %}
Depending on the system language, the group may also appear under the name:
```bash
Domain Admins
```
or:
```bash
Domain Admins
```
This command returns the permissions applied to the object, but identities often appear as **SID**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/active-directory/acl-security-descriptors-and-permissions/vulnerable-acl-identification.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)