GenericWrite

GenericWrite allows writing the non-protected attributes of an Active Directory object. It is not full control (it cannot rewrite the DACL or reset the password directly), but choosing which attribute to write is usually enough to escalate. It is a recurring piece of ACL abuse, and the concrete abuse again depends on the object type and the attribute touched.

Over a user. Three classic routes, from noisiest to stealthiest:

• Shadow Credentials (the modern favourite): write msDS-KeyCredentialLink to authenticate by certificate without changing anything visible. See Shadow Credentials.
• SPN-jacking: writing a servicePrincipalName onto the account makes it kerberoastable, letting you crack its password offline. See targeted Kerberoasting.
• Logon script: set scriptPath or msTSInitialProgram to run something the next time the user logs on (depends on them actually logging on, so it is the least reliable).

# shadow credentials (pywhisker / certipy)
certipy shadow auto -u <me>@<domain> -p <pass_me> -account <victim>

# SPN-jacking + roast (targetedKerberoast)
targetedKerberoast.py -v -d <domain> -u <me> -p <pass_me> --request-user <victim>

Over a group. GenericWrite includes writing the member attribute, i.e. adding yourself to the group. If the group is privileged, direct escalation.

net rpc group addmem "<group>" <me> -U '<domain>/<me>%<pass_me>' -S <dc>
bloodyAD -d <domain> -u <me> -p <pass_me> --host <dc> add groupMember "<group>" <me>
# on Windows
Add-DomainGroupMember -Identity "<group>" -Members <me>

Over a computer. Write msDS-KeyCredentialLink (Shadow Credentials against the machine account) or, if the environment allows, steer towards RBCD.

Verification. After the abuse, check it: Get-ADUser <victim> -Properties servicePrincipalName to confirm the injected SPN, or the TGT obtained with the certificate. The check is the proof.

Nuance. SPN-jacking depends on the account being enabled, on its password being weak (if it is long and random, the roast never cracks) and on the KDC accepting the SPN; it is not guaranteed RCE, it is a door to an offline crack. Against GenericAll, GenericWrite is a subset: it cannot rewrite the DACL or take ownership, only write attributes.

How to detect it. Writing an attribute leaves an Event ID 5136 (a directory service object was modified) on the DC, with the name of the touched attribute: a servicePrincipalName freshly set on a user account is SPN-jacking, and msDS-KeyCredentialLink on an account that never used certificate authentication is Shadow Credentials. It requires enabling Audit Directory Service Changes and a SACL on the objects. If the SPN-jacking succeeds, the follow-up roast also shows up as an Event ID 4769 with RC4 encryption (0x17). Adding yourself to a group generates 4728/4732/4756. The strong signal is the changed attribute paired with an actor that does not administer the directory.

Defence. Least privilege on attributes, and long passwords or gMSAs on service accounts so a targeted roast buys nothing even if the SPN does get injected.