BloodHound Deep Dive Part 6: From GenericAll to a Working Credential

Part 4 found the chain: j.reyes, through IT-HELPDESK’s GenericAll over Backup Operators, through Backup Operators’ ForceChangePassword over svc-legacy-scan, reaches a credential reset with no existing password required. This post walks what turning that graph edge into an actual working credential looks like, and the real tool built specifically to do it.

What the edges mean in LDAP terms

GenericAll on a group object grants full control over that object, which in practical terms means the holder can write the group’s member attribute directly, adding any principal, including themselves, as a member. It’s not a BloodHound abstraction: it’s the standard AD access right ADS_RIGHT_GENERIC_ALL, visible in dsacls output on a real domain controller as FULL CONTROL. j.reyes, as a member of IT-HELPDESK, can add j.reyes to Backup Operators through nothing more exotic than an LDAP modify operation.

ForceChangePassword is narrower and, for this chain, more useful: it’s the AD extended right Reset-Password (GUID 00299570-246d-11d0-a768-00aa006e0529), and it lets the holder set a brand-new password for the target account without ever supplying, or even knowing, the account’s current one. Once j.reyes is a member of Backup Operators, Backup Operators’ ForceChangePassword over svc-legacy-scan is directly usable: no need to actually add j.reyes to the group first, since group-inherited rights apply the moment the token reflects membership at the next authentication, or, in tools that resolve rights live over LDAP rather than relying on a cached Kerberos ticket, immediately.

bloodyAD

Turning either of those edges into an action means writing to LDAP, and the tool purpose-built for that, verified directly from its own repository rather than assumed, is bloodyAD, described by its own README as “an Active Directory privilege escalation swiss army knife.” It performs targeted LDAP calls against a domain controller to carry out exactly the class of abuse BloodHound’s ACL edges describe: adding group members, resetting passwords, and manipulating object ownership and DACLs directly. It supports cleartext passwords, pass-the-hash, pass-the-ticket, and certificate authentication, and, notably for this site’s Pivoting and Tunneling coverage, is explicitly designed to work transparently through a SOCKS proxy, meaning a chisel or ligolo-ng tunnel from that series drops straight in front of it with no extra wrapping. Its README credits Impacket directly: several of its LDAP attack primitives are built on structures and techniques from Impacket’s own ldapattack.py, making it less a competitor to the Impacket series than a purpose-built extension of it for ACL abuse specifically, the one class of attack Impacket’s own toolset, focused on Kerberos and SMB rather than LDAP writes, doesn’t cover.

The tool’s own documented usage example shows the shape of the command, a password reset using pass-the-hash authentication:

$ bloodyAD --host 172.16.1.15 -d bloody.local -u jane.doe -p :70016778cb0524c799ac25b439bd6a31 set password john.doe 'Password123!'

Translated to this lab, once j.reyes’s Backup Operators membership is in effect, the equivalent operation resets svc-legacy-scan’s password directly:

$ bloodyAD --host 10.10.30.10 -d CONTOSO.LOCAL -u j.reyes -p 'Summer2026!' set password svc-legacy-scan 'N3wP4ssw0rd!'

No hash to crack, no hashcat runtime, no dependency on svc-legacy-scan’s original password being weak at all. This is the same account Password Cracking and Wordlist Engineering Part 3 spent effort cracking via AS-REP roasting, Sc4nn3r2019!, reached here through an entirely different, non-cryptographic route. Both are valid paths to the same account. Only one of them depends on password strength.

Automating the graph-to-exploit step

A related tool worth naming, not used in this walkthrough but directly relevant to where this chain is headed defensively in Part 7: autobloody, which reads a BloodHound-identified privilege escalation path and drives bloodyAD to exploit it automatically, closing the loop from graph query to working credential with no manual translation step in between. That automation is exactly the kind of recognizable pattern a defender watching LDAP write volume should be looking for, a single low-privilege account suddenly performing a targeted sequence of group-membership and password-reset writes against accounts it has never touched before.

Where GenericAll on a group ends and doesn’t end

It’s worth being precise about what this chain actually delivered: a working password for svc-legacy-scan, a standard domain user with no further group memberships or ACL exposure modeled anywhere in this lab’s graph. It is not, on its own, a path to Domain Admins, the same honest limitation Part 5 found when Kerberoasting svc-backup. A real engagement doesn’t stop at “found a working credential,” it goes back to the graph and asks what that credential now unlocks that it didn’t before, new sessions, new local admin rights, new group memberships to enumerate from a fresh vantage point. That loop, not a single chain, is what a real BloodHound-driven engagement actually looks like, and it’s the shape Part 8 of this series follows end to end.

Next: Part 7, where the same collection run and ACL abuse chain get looked at from the defender’s side: what SharpHound’s own documented behavior leaves behind, and what a sudden LDAP write from j.reyes actually looks like in the logs.