Command Manager

bloodyAD Get Object Attributes

Read all (or specific) LDAP attributes of an AD object. Useful for confirming msDS-AllowedToActOnBehalfOfOtherIdentity, msDS-KeyCredentialLink, userAccountControl flags, or any attribute after a write.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
bloodyAD
Category
Enumeration / LDAP
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' get object '<target>'

Credential variants

The same attack using a different authentication material.

Specific Attribute requires password

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' get object '<target>' --attr msDS-AllowedToActOnBehalfOfOtherIdentity

Writable Attributes Only requires password

bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' get writable

Examples

bloodyAD --host 10.10.10.10 -d corp.local -u jdoe -p 'Password123!' get object jdoe

Tags

bloodyad ldap enumeration

References