Abusable ACLs

• GenericAll: Full permissions over the target object. All the actions are allowed, e.g. permission to change password, add to group, delete the object, ability for impersonation, etc...
• ResetPassword: Permission to change the target user’s password without knowing its previous one.
  Formal ACL name is User-Force-Change-Password
• WriteDACL: Permission to add new ACL (Access List) permissions to the target object. For example, an attacker can give himself 'full control' over the target object.
• Owner: The owner of the object has full permission over it. A malicious owner could perform all the malicious action he wants.
• Write Owner: Permission to update the owner of a target object. An object's owner has full control over the target object.
• WriteMembers: Permission to add mwembers (users, groups or computers) to the target group.
• GenericWrite: Permission to update sensitive parameters of the target object. For example, update the “scriptPath” parameter value on a target user object to cause that user to run your specified executable/commands the next time that user logs on.
• WriteScript: Permission to write the target object's initiation script. It can be abused easily by an attacker to run malicious commands over the target object.
• ExtendedAll: Permission to perform any action associated with extended Active Directory rights against the object. For example, adding principals to a group and force changing a target user’s password are both examples of extended rights.
• DCSync: The ability to request password hashes for all users in the domain (including the password hash of the Kerberos Key Distribution Center, krbtgt), without having local domain admin rights on the domain controller and without being a member of any privileged group.