Covers step 5 of OSCP AD Set - Assumed Breach Methodology. Once BloodHound Collection or Manual LDAP Enumeration shows a path, match the edge to the abuse technique below. See BloodHound Edge Risk for the severity table.

Common OSCP-Relevant Abuses

• GenericAll/GenericWrite on user -> net rpc password / Set-DomainUserPassword / targeted ForceChangePassword
• GenericAll/WriteDacl on group -> add self as member
• WriteOwner -> take ownership -> grant self GenericAll -> abuse as above
• AddSelf -> add self to a privileged group directly
• Shadow Credentials (AddKeyCredentialLink) -> pywhisker to add a cert, auth via PKINIT with certipy or gettgtpkinit.py
• ADCS ESC1/ESC8 if a CA is present -> certipy find then certipy req

Forced Password Reset (ForceChangePassword)

Target is the account being changed. Optional: privileged account performing the change goes in -altuser/-altpass (or -althash):

impacket-changepasswd '<domain>/<target-user>@<DC-IP>' -newpass 'NewPass123!' -altuser '<priv-user>' -altpass '<priv-pass>' -dc-ip <DC-IP> -reset -protocol smb-samr

Next

A new privileged account opens up Lateral Movement, or straight to DCSync & DC Takeover if it's DA-equivalent.