Permission Issues and Constraint Errors even with Bloodhound saying its vuln about acltoolkit HOT 1 CLOSED

Hello

First about AdminCount :

Question: What is AdminCount, and why is it not being decremented to ‘0’ or ‘’ when I remove a user from a

Protected Group?

Answer: AdminCount is an attribute on the user account that is set to 1 on any users being protected by AdminSdHolder. When protected, the user gets this attribute set and the security inheritance bit is removed from their account.

The reason AdminCount isn’t set back to 0 when the user is removed from a protected group is that you told us not to! A survey of customers early on in Windows 2000's design found that they favored deleting a user account after its high-privilege rights were revoked, as the account could have created explicit backdoors before having its rights stripped. Therefore the DC does not remove the AdminCount attribute entry, as it is assumed that the account is going to be disabled or deleted.

If for some reason you didn’t want to get rid of that account after ‘de-admining’ it, you must manually set back to allowing inheritance and set AdminCount to 0, usually through ADSIEDIT.MSC..

more here

Also, about give_dcsync action of acltoolkit, there was a bug, which I fixed in cddc37f9. So now it should work well.

About get-objectacl: The ACEs of an object describe what permissions other object have on it, not the opposite.

About your attack paths in BH: I don't really know why it is not working, could be inheritence problem, or BH false positive, or anything else.

To help you to dig on the subject, here are some great resources:

• https://www.thehacker.recipes/ad/movement/dacl
• https://mayfly277.github.io/posts/GOADv2-pwning-part11/
• https://specterops.io/wp-content/uploads/sites/3/2022/06/an_ace_up_the_sleeve.pdf

from acltoolkit.