> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/active-directory/acl-security-descriptors-and-permissions/vulnerable-acl-identification.md).
# 识别易受攻击的 ACL
针对识别易受攻击的 ACL 的 Active Directory 安全笔记，涵盖枚举、Kerberos、凭据、ACL 滥用、横向移动、利用流程和验证步骤。
要开始分析，你可以筛选一个敏感组的 ACL，例如域管理员组。
易受攻击的 ACE 列表
**ForceChangePassword**：提供无需知道目标用户当前密码即可更改其密码的能力。可被以下方式滥用 `Set-DomainUserPassword`.
**AddMembers**：提供向目标组添加任意用户、组或计算机的能力。可被以下方式滥用 `Add-DomainGroupMember`.
**GenericAll**：赋予对该对象的完全控制权。例如，这包括向组中添加其他用户、在不知道用户当前密码的情况下更改其密码，或在用户对象上保存 SPN 的能力。可被以下方式滥用 `Set-DomainUserPassword` 或 `Add-DomainGroupMember`.
**GenericWrite**：赋予修改目标对象任何未受保护属性的能力。例如，修改 `scriptPath` 属性，使目标用户在下次登录时运行指定的命令或可执行文件。可被以下方式滥用 `Set-DomainObject`.
**WriteOwner**：赋予修改目标对象所有者的能力。一旦对象所有者被更改为攻击者控制的用户，攻击者就可以按照随后赋予自己的权限来操作该对象。可被以下方式滥用 `Set-DomainObjectOwner`.
**WriteDACL**：赋予在目标对象的 DACL 中写入新的 ACE 的能力。例如，攻击者可以在目标对象的 DACL 中添加新的 ACE，以便授予自己对该对象的完全控制权。可被以下方式滥用 `Add-NewADObjectAccessControlEntry`.
**AllExtendedRights**：提供在目标对象上执行与 Active Directory 扩展权限相关的所有操作的能力。例如，将用户添加到组中，或强制目标用户更改密码。可被以下方式滥用 `Set-DomainUserPassword` 或 `Add-DomainGroupMember`.
{% code overflow="wrap" %}
```powershell
Get-DomainObjectAcl -Identity "Domain Admins"
```
{% endcode %}
根据系统语言，组也可能显示为：
```bash
Domain Admins
```
或：
```bash
Domain Admins
```
此命令返回应用于该对象的权限，但标识通常显示为 **SID**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/active-directory/acl-security-descriptors-and-permissions/vulnerable-acl-identification.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)