🧠Active Directory - ACL Abuse (GenericAll & ForceChangePassword)
What is it?
- Concept: Every AD object carries a DACL (Discretionary Access Control List) of ACEs (Access Control Entries) describing exactly which principals can do what to it.
GenericAllgrants full control over the target object (owns it, in practice);ForceChangePasswordgrants the narrower right to reset the target’s password without knowing the current one. Both are frequently handed out — deliberately (helpdesk delegation) or by accident (over-broad group nesting) — to accounts that were never meant to be that powerful. - Impact: Full takeover of the target account (password reset = authenticate as them), which can then be chained: if the newly-controlled account holds its own ACEs over a third account, one foothold turns into a multi-hop path across the domain.
How it works
BloodHound models these ACEs as graph edges from principal to target. GenericAll is the broadest — it implies every specific right including password reset, group membership changes, and SPN writes. ForceChangePassword is the User-Force-Change-Password extended right specifically: it lets the holder call the equivalent of “reset password” (no old password needed), but doesn’t grant anything else on the object. Either one is enough to fully compromise a user account outright, converting “control over an AD object” directly into “valid credentials for it.”
Because control doesn’t stop propagating at the first hop — the newly-owned account can hold its own ACEs over other objects — a single leaked/reset account can be the start of a chain: reset user A, log in as A, discover A has rights over user B, reset B, and so on until landing on an account with a genuinely high-value right (DCSync, admin group membership, etc.).
Exploitation
Prerequisites
- Valid credentials for a principal BloodHound shows holding
GenericAll,GenericWrite, orForceChangePasswordon a target user
Finding the edge
bloodhound-python -u '<user>' -p '<pass>' -d <domain> -ns <dc_ip> -c all --zipLoad the resulting zip into BloodHound CE and check Outbound Object Control on the compromised principal’s node — GenericAll/ForceChangePassword edges to other users are exactly what to chase first, since they’re a guaranteed win (no cracking, no guessing).
Attack Vectors
# Reset the target's password outright — no old password required
net rpc password "<target_user>" "<new_password>" -U "<domain>/<user>%<pass>" -S <dc_ip># Alternative: bloodyAD (works over LDAP, useful when SMB/RPC is filtered)
bloodyAD --host <dc_ip> -d <domain> -u '<user>' -p '<pass>' set password <target_user> '<new_password>'Authenticate as <target_user> with the new password and repeat the BloodHound check from their perspective — that’s the next hop, if one exists.
Notes
net rpc passwordneedssamba-common-bin(apt install smbclientpulls it in on Kali) and talks to the domain over RPC — no special Kerberos setup required, plain NTLM auth works.- Overwriting a real user’s password is destructive to that account’s legitimate access — on an engagement (not a lab box), this needs explicit authorization and coordination, since the original owner is locked out until it’s reset back.
GenericWrite(rather thanGenericAll) doesn’t include password reset, but does allow writing arbitrary attributes on the target — includingservicePrincipalName, which opens up Active Directory - Targeted Kerberoasting as a non-destructive alternative when overwriting the real password isn’t acceptable.
Mitigation
- Fix: Audit AD object ACLs regularly (BloodHound itself, or
Get-ADObject/dsaclssweeps) and remove delegated rights that don’t map to an actual documented business need. Treat any account holdingGenericAll/ForceChangePasswordon another user as a privileged account in its own right, subject to the same monitoring and hardening as admin accounts.
Related Usage
| File | Created |
|---|---|
| HTB - Administrator | Wednesday, July 22nd 2026, 5:00:00 am |
References: