> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/acl-security-descriptors-and-permissions/vulnerable-acl-identification.md).
# 识别易受攻击的 ACL
要开始分析，你可以筛选一个敏感组的 ACL，例如域管理员组。
存在漏洞的 ACE 列表
**ForceChangePassword**：允许在不知道目标用户当前密码的情况下更改其密码。可与以下工具滥用 `Set-DomainUserPassword`.
**AddMembers**：允许向目标组添加任意用户、组或计算机。可与以下工具滥用 `Add-DomainGroupMember`.
**GenericAll**：对对象拥有完全控制权。例如，这包括将其他用户添加到某个组、在不知道用户当前密码的情况下更改用户密码，或在用户对象上保存 SPN 的能力。可与以下工具滥用 `Set-DomainUserPassword` 或 `Add-DomainGroupMember`.
**GenericWrite**：允许修改目标对象的任何未受保护属性。例如，修改 `scriptPath` 目标用户的属性，使该用户在下次登录时运行指定的命令或可执行文件。可与以下工具滥用 `Set-DomainObject`.
**WriteOwner**：允许修改目标对象的所有者。一旦对象所有者被更改为攻击者控制的用户，攻击者就可以按照随后赋予自己的权限来操纵该对象。可与以下工具滥用 `Set-DomainObjectOwner`.
**WriteDACL**：允许在目标对象的 DACL 中写入新的 ACE。例如，攻击者可以在目标对象的 DACL 中添加新的 ACE，以授予自己对此对象的完全控制权。可与以下工具滥用 `Add-NewADObjectAccessControlEntry`.
**AllExtendedRights**：允许对目标对象执行与 Active Directory 扩展权限相关的所有操作。例如，将用户添加到组，或强制目标用户更改密码。可与以下工具滥用 `Set-DomainUserPassword` 或 `Add-DomainGroupMember`.
{% code overflow="wrap" %}
```powershell
Get-DomainObjectAcl -Identity "Domain Admins"
```
{% endcode %}
根据系统语言不同，该组也可能显示为：
```bash
Domain Admins
```
或者：
```bash
Domain Admins
```
此命令返回应用于该对象的权限，但标识通常显示为 **SID**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/active-directory/acl-security-descriptors-and-permissions/vulnerable-acl-identification.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.