Install via uv or pipx — keep it isolated from system Python
Confirm DC reachability + clock skew (Kerberos abuse breaks past 5 min drift)
Enumerate first: get writable --detail to see what the controlled principal can actually change
Map the right action to the abuse: add genericAll / set owner / add shadowCredentials / add rbcd / set servicePrincipalName
Prefer Shadow Credentials over password reset when the user is active (resets are noisy)
Clean up: revert SPNs, drop added group memberships, remove shadowCredentials when done
🎯 Operational Context
Use when: You have valid AD credentials (password, hash, or Kerberos ticket) and want a single Python tool that handles enumeration, ACL abuse, UAC flag flips, RBCD, Shadow Credentials, DNS record planting, and tombstone restore — all over LDAP without needing Windows.
Think Dumber First: BloodyAD is a Swiss-army knife. get writable --detail tells you what’s possible; the verb (add / set / remove) tells you the action; the noun (genericAll, shadowCredentials, uac, rbcd, password, groupMember) tells you the abuse primitive.
Skip when: You need Windows-only tooling (Rubeus, PowerView in-memory) or you’re outside a network path to LDAP/LDAPS on the DC.
Bind a certificate identity to a target user (ESC14B)
📝 Notes
Pass -k to use Kerberos authentication.
Pass an NT hash instead of a password using -p :[NTLM_HASH].
Specify the credential format for --password or -k using -f, e.g. -f rc4.
🛠️ Troubleshooting & Edge Cases
Problem
Cause
Fix
LDAP bind fails over plaintext
DC enforces LDAP signing / channel binding
Use --ldaps, or Kerberos with -k
KRB_AP_ERR_SKEW
Clock drift > 5 min from DC
sudo ntpdate [DC] or sudo rdate -n [DC]
add computer fails with quota error
ms-DS-MachineAccountQuota exhausted for this user
Use a different account or raise MAQ if you have rights on the domain object
add shadowCredentials fails
DC has no NTAuth cert / PKINIT not configured
Fall back to targeted Kerberoast or password reset
get writable returns nothing
Stale BloodHound data — rights were revoked or principal lacks reach
Re-enumerate with a different ingestion path; check inheritance and explicit DENY
set restore fails
User missing the Reanimate-Tombstones extended right
Use a principal with that right (typically Domain Admins)
📝 Reporting Trigger
Finding Title: Active Directory Object Modification Permissions Enable Privilege Escalation via BloodyAD
Impact: Excessive write permissions across AD objects allow lower-privileged principals to perform ACL abuse, plant Shadow Credentials, configure RBCD, modify UAC flags, register DNS records, and restore tombstoned objects — all from a single Python tool with no Windows host required.
Root Cause: Permissions delegated without least-privilege review; non-zero ms-DS-MachineAccountQuota; missing LDAP signing / channel binding; lack of monitoring for msDS-KeyCredentialLink, servicePrincipalName, and userAccountControl modifications.
Recommendation: Audit writable attributes on Tier 0 objects. Set ms-DS-MachineAccountQuota = 0. Enforce LDAP signing + channel binding. Alert on KeyCredentialLink writes, SPN changes, UAC flag toggles (TRUSTED_TO_AUTH_FOR_DELEGATION), and RBCD additions.