> For the complete documentation index, see [llms.txt](https://zflemingg1.gitbook.io/undergrad-tutorials/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zflemingg1.gitbook.io/undergrad-tutorials/active-directory-acl-abuse/genericwrite-exploit.md).

# GenericWrite Exploit

Refer to: https\://www\.youtube.com/watch?v=ob9SgtFm6\_g\&t=1431s

## What are Generic rights?

Generic rights include GenericAll and GenericWrite, which implicitly grant particular object-specific rights. The control rights we care about are WriteDacl and WriteOwner, which allow for the modification of the DACL and the owner of an object, respectively. Since the owner of an Active Directory object implicitly grants complete control of an object, ownership modification is a valuable object takeover primitive.

## Scenario:

You have managed to compromise an account belonging to Claire. Your goal is to gain access to the Backup\_Admins group. The user <CLAIRE@HTB.LOCAL> has **generic write** access to the group <BACKUP_ADMINS@HTB.LOCAL>.&#x20;

Generic Write access grants you the ability to write to any non-protected attribute on the target object, including **"members" for a group**, and "serviceprincipalnames" for a user.

![Attack Path](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MQDPiK8pv-CMPIcjR06%2F-MQDPrmsAQfv285AP6hj%2Fimage.png?alt=media\&token=5889ed64-0784-4dcc-b504-3eb24159bde9)

Guided by the [*An Ace Up The Sleeve*](https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf) article, we can update the `BACKUP_ADMINS`object's attributes since we have the `GenericWrite` permissions.&#x20;

![Current Users in the Backup Admins Group](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MQDPiK8pv-CMPIcjR06%2F-MQDQ-HUeqSL5ZveSO2P%2Fimage.png?alt=media\&token=d8a8badb-395e-41e6-84fc-da65f2d31121)

![Successfully Added Claire to the Backup\_Admins Group](https://1775797756-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzJDg7CZO0BbVixCJaI%2F-MQDPiK8pv-CMPIcjR06%2F-MQDQ6iUFVAYFISX54gN%2Fimage.png?alt=media\&token=e0d89cc5-960c-43c4-85f5-c2f55a8d8fcd)