Abusable ACLs

• Chng-Password: The ability to change the target user’s password without knowing the current value.
  Formal ACL name is User-Force-Change-Password
  
• WriteMembers: The ability to add arbitrary users, groups or computers to the target group.
• GenericAll: Full object control, including the ability to add other principals to a group, change a user password without knowing its current value, register an SPN with a user object, etc...
• GenericWrite: The ability to update any non-protected target object parameter value. For example, update the “scriptPath” parameter value on a target user object to cause that user to run your specified executable/commands the next time that user logs on.
• Owner (WriteOwner): The ability to update the owner of the target object. Once the object owner has been changed to a principal the attacker controls, the attacker may manipulate the object any way they see fit.
• WriteDACL: The ability to write a new ACE to the target object’s DACL. For example, an attacker may write a new ACE to the target object DACL giving the attacker “full control” of the target object.
• ExtendedAll: The ability to perform any action associated with extended Active Directory rights against the object. For example, adding principals to a group and force changing a target user’s password are both examples of extended rights. Abused with Set-DomainUserPassword or Add-DomainGroupMember.
• DCSync: The ability to request password hashes for all users in the domain (including the password hash of the Kerberos Key Distribution Center, krbtgt), without having local domain admin rights on the domain controller and without being a member of any privileged group