Active Directory Acl Abuse

This is a practical reference for exploiting misconfigured Active Directory permissions, covering the full chain from BloodHound enumeration through execution. It maps out dangerous ACEs like GenericAll, WriteDACL, and ForceChangePassword with specific commands for each scenario. You get concrete examples for DCSync attacks, shadow credentials via msDS-KeyCredentialLink manipulation, LAPS password extraction, and GPO abuse with SharpGPOAbuse. The ACE comparison table is genuinely useful for quickly determining what you can do with a given permission. Load this when you've found an exploitable ACL path and need the exact syntax to abuse it, whether you're working from Windows with PowerView or Linux with Impacket.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill active-directory-acl-abuse --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: AD ACL Abuse — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert AD ACL abuse techniques. Covers BloodHound enumeration, dangerous ACEs (GenericAll, WriteDACL, WriteOwner, etc.), DCSync, shadow credentials, targeted kerberoasting, group manipulation, LAPS, and GPO abuse. Base models miss complex ACL chain exploitation and Cypher query patterns.

0. RELATED ROUTING

Before going deep, consider loading:

active-directory-kerberos-attacks for Kerberos attacks often chained with ACL abuse
active-directory-certificate-services for certificate-based attacks after ACL exploitation
ntlm-relay-coercion for relay attacks that can set ACLs (LDAP relay)
windows-lateral-movement after gaining elevated AD access