How do I install the Ad Dacl Abuse skill?

Run npx skillmds@latest add noorqureshi/ad-dacl-abuse in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ad Dacl Abuse safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ad Dacl Abuse?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ad Dacl Abuse free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ad Dacl Abuse?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ad Dacl Abuse by noorqureshi — Agent Skill

Name: Ad Dacl Abuse
Author: NoorQureshi

Ad Dacl Abuse

Abuse Active Directory object ACLs/DACLs for lateral movement and escalation — GenericAll, WriteDACL, GenericWrite, WriteOwner, AddMember, ForceChangePassword, and DCSync rights. Load with domain creds + BloodHound showing an ACL edge, on "GenericAll", "WriteDACL", "DCSync", "abuse this edge".

NoorQureshi Updated Sep 17, 2026

File contents

AD ACL / DACL abuse

When it applies

You have domain creds and BloodHound shows your principal (or one you control) has a dangerous ACL edge over another object — a user, group, computer, GPO, or the domain. These edges chain into a path to Domain Admin without any CVE.

Why it works

AD access control is a web of object permissions. Over-permissive ACLs let you modify other principals: reset a password, add yourself to a privileged group, take ownership then rewrite the DACL, or grant yourself DCSync — each turning a small right into control.

Method — abuse per edge (BloodHound names the edge; it also shows the command)

ForceChangePassword over a user → reset their password: net rpc password / bloodyAD set password.
GenericWrite / GenericAll over a user → set an SPN and Kerberoast, or set msDS-KeyCredentialLink (shadow credentials, certipy shadow/pywhisker) → auth as them.
AddMember / GenericAll over a group → add yourself to it (e.g. a privileged group): net group ... /add.
WriteDACL / WriteOwner over an object → take ownership, grant yourself GenericAll, then abuse as above.
DCSync rights (GetChanges/GetChangesAll on the domain) → impacket-secretsdump -just-dc to dump all hashes incl. krbtgt (→ golden ticket).
GPO edit rights → push a scheduled task/immediate task to hosts the GPO applies to → RCE.

Gotchas

Let BloodHound plan the path — abuse edges in order; each step unlocks the next.
Shadow credentials (KeyCredentialLink) need a 2016+ DC with PKINIT — often cleaner than a password reset (less noisy, reversible).
Clean up: remove added group memberships / added creds after proving impact.

Verify success

Control of the target principal (password/hash/TGT), membership in a privileged group, or a hash dump via DCSync — advancing the path toward DA.

References

SpecterOps BloodHound docs (edge abuse); harmj0y "ACL attacks"; impacket/bloodyAD.

---name: ad-dacl-abusedescription: Abuse Active Directory object ACLs/DACLs for lateral movement and escalation — GenericAll, WriteDACL, GenericWrite, WriteOwner, AddMember, ForceChangePassword, and DCSync rights. Load with domain creds + BloodHound showing an ACL edge, on "GenericAll", "WriteDACL", "DCSync", "abuse this edge".---# AD ACL / DACL abuse## When it appliesYou have domain creds and BloodHound shows your principal (or one you control) has a dangerous**ACL edge** over another object — a user, group, computer, GPO, or the domain. These edges chaininto a path to Domain Admin without any CVE.## Why it worksAD access control is a web of object permissions. Over-permissive ACLs let you *modify* otherprincipals: reset a password, add yourself to a privileged group, take ownership then rewrite theDACL, or grant yourself DCSync — each turning a small right into control.## Method — abuse per edge (BloodHound names the edge; it also shows the command)1. **ForceChangePassword** over a user → reset their password: `net rpc password` / `bloodyAD set password`.2. **GenericWrite / GenericAll over a user** → set an SPN and Kerberoast, or set `msDS-KeyCredentialLink` (shadow credentials, `certipy shadow`/`pywhisker`) → auth as them.3. **AddMember / GenericAll over a group** → add yourself to it (e.g. a privileged group): `net group ... /add`.4. **WriteDACL / WriteOwner over an object** → take ownership, grant yourself GenericAll, then abuse as above.5. **DCSync rights** (GetChanges/GetChangesAll on the domain) → `impacket-secretsdump -just-dc` to dump all hashes incl. krbtgt (→ golden ticket).6. **GPO edit rights** → push a scheduled task/immediate task to hosts the GPO applies to → RCE.## Gotchas- Let BloodHound plan the *path* — abuse edges in order; each step unlocks the next.- Shadow credentials (KeyCredentialLink) need a 2016+ DC with PKINIT — often cleaner than a password reset (less noisy, reversible).- Clean up: remove added group memberships / added creds after proving impact.## Verify successControl of the target principal (password/hash/TGT), membership in a privileged group, or a hashdump via DCSync — advancing the path toward DA.## ReferencesSpecterOps BloodHound docs (edge abuse); harmj0y "ACL attacks"; impacket/bloodyAD.

Frequently asked questions