Disclaimer: This material is provided for educational purposes and authorized security testing only. You are solely responsible for how you use the information. Do not use these techniques on systems without explicit permission from the owner. We do not encourage any kind of illegal or harmful activity

Introduction

ACL (Access Control List) enumeration is a critical step in understanding permissions and potential attack paths within an Active Directory (AD) environment.
This cheat sheet covers the use of PowerView for manual enumeration and BloodHound for graphical representation and attack path discovery.

Step 1: Convert Usernames to SIDs and Retrieve ACLs

1. Import the PowerView module
   

   Import-Module .\PowerView.ps1
   

2. Convert a username to a SID
   

   $userSID = Convert-UserToSID -Username mthompson
   

3. Get domain object ACLs for that SID
   

   Get-DomainObjectACL -Identity * | Where-Object {$_.SecurityIdentifier -eq $userSID}
   

4. Resolve GUID values into human-readable format
   

   Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_.SecurityIdentifier -eq $sid}
   

Step 2: Work with Specific GUIDs

1. Set a GUID
   

   $guid = "3e0abfd0-1261-11d0-a060-00aa006c33ed"
   

2. Find its mapping in AD
   

   Get-ADObject -SearchBase "CN=Extended-Rights,$((Get-ADRootDSE).ConfigurationNamingContext)" -Filter {ObjectClass -like 'ControlAccessRight'} -Properties * | Select-Object Name,DisplayName,DistinguishedName,rightsGuid | Where-Object {$_.rightsGuid -eq $guid} | Format-List
   

Step 3: Repeat for Additional Users and Groups

1. Convert another username to SID
   

   $sid2 = Convert-NameToSid -Username nwalker
   

2. Enumerate rights for that SID
   

   Get-DomainObjectACL -ResolveGUIDs -Identity * | Where-Object {$_.SecurityIdentifier -eq $sid2} -Verbose
   

3. Check group nesting
   

   Get-DomainGroup -Identity "Finance Team" | Select-Object memberof
   

4. Convert a group name to SID
   

   $securityGroupSID = Convert-NameToSid -Username "Security Operations"
   

5. Enumerate rights for that group SID
   

   Get-DomainObjectACL -ResolveGUIDs -Identity * | Where-Object {$_.SecurityIdentifier -eq $securityGroupSID} -Verbose
   

6. Convert another username to SID
   

   $jdoeSID = Convert-NameToSid -Username jdoe
   

7. Enumerate rights for that SID
   

   Get-DomainObjectACL -ResolveGUIDs -Identity * | Where-Object {$_.SecurityIdentifier -eq $jdoeSID} -Verbose