bloodyAD set restore
Restore a tombstoned object from the AD recycle bin. Useful for resurrecting accounts you accidentally deleted during an engagement, or for recovering objects a defender purged mid-test.
- Tool
- bloodyAD
- Category
- Post-Exploitation / AD Object Manipulation
- Platform
- linux
- Requires
- password
- Protocols
- LDAP
Syntax
Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.
bloodyAD --host <dc-ip> -d '<domain>' -u '<user>' -p '<password>' set restore '<deleted-dn>'Examples
bloodyAD --host 10.10.10.10 -d corp.local -u admin -p 'Password123!' set restore 'CN=svc_app\0ADEL:abcd...,CN=Deleted Objects,DC=corp,DC=local'Tags
Related commands
- bloodyAD add dnsRecord Create a new AD-integrated DNS record. Authenticated users can create records by default…
- bloodyAD Add GenericAll Grant attacker GenericAll over a target object via LDAP. Requires WriteDacl or Owner on…
- bloodyAD Add Group Member Add a user/computer to a group via LDAP. Common abuse path when GenericAll/WriteProperty…
- bloodyAD Create User Create a new domain user object. Requires Create Child rights on a Users container…
- bloodyAD remove object Delete an arbitrary AD object you have rights on. Cleanup step for accounts/computers…
- Impacket addcomputer.py Add a machine account to the domain using the default MachineAccountQuota (10).…
- Impacket Net Enumerate AD users, groups, and shares via Net commands over SMB
- Impacket Remote Registry Query, add, or save remote registry hives over SMB without dropping a binary on the…