Authorization Intelligence • Refined Analysis

AD AuthGraph

● BLUES.LOCAL
Collection   2026-04-24 16:18:18
Refined     2026-04-24 10:48:45
Report      2026-04-24 16:18:45
Executive Summary
ACL Abuse Chains
48
DA Path Holders
7
identities → Domain Admins
Kerberoastable
3
Delegation Risks
1
configured delegations
Registry Size
88
AD objects tracked
ACL Abuse Chains 48 findings  ·  0 high-priority
Administrators → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner
Chain: 2 hops
Source Proximity: prox: 0
Target Proximity: prox: 0
Authorities Gained: Administrators
Group:Administrators can use has_WriteDACL_on on Group:Domain Admins to gain access to Domain Admins via: Group:Administrators -> Group:Domain Admins
Enterprise Admins → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner
Chain: 2 hops
Source Proximity: prox: 0
Target Proximity: prox: 0
Authorities Gained: Enterprise Admins
Group:Enterprise Admins can use has_WriteDACL_on on Group:Domain Admins to gain access to Domain Admins via: Group:Enterprise Admins -> Group:Domain Admins
Administrators → Director → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Administrators
Group:Administrators can use has_WriteDACL_on on Group:Director to gain access to Domain Admins via: Group:Administrators -> Group:Director -> Group:Domain Admins
Enterprise Admins → Director → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Enterprise Admins
Group:Enterprise Admins can use has_WriteDACL_on on Group:Director to gain access to Domain Admins via: Group:Enterprise Admins -> Group:Director -> Group:Domain Admins
Administrators → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Administrators
Group:Administrators can use has_WriteDACL_on on User:vkohli to gain access to Domain Admins via: Group:Administrators -> User:vkohli -> Group:Domain Admins
Enterprise Admins → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Enterprise Admins
Group:Enterprise Admins can use has_WriteDACL_on on User:vkohli to gain access to Domain Admins via: Group:Enterprise Admins -> User:vkohli -> Group:Domain Admins
Administrators → Administrator → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Administrators
Group:Administrators can use has_WriteDACL_on on User:Administrator to gain access to Domain Admins via: Group:Administrators -> User:Administrator -> Group:Domain Admins
Enterprise Admins → Administrator → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Enterprise Admins
Group:Enterprise Admins can use has_WriteDACL_on on User:Administrator to gain access to Domain Admins via: Group:Enterprise Admins -> User:Administrator -> Group:Domain Admins
Administrators → jbumrah → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Administrators
Group:Administrators can use has_WriteDACL_on on User:jbumrah to gain access to Domain Admins via: Group:Administrators -> User:jbumrah -> Group:Domain Admins
Enterprise Admins → jbumrah → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Enterprise Admins
Group:Enterprise Admins can use has_WriteDACL_on on User:jbumrah to gain access to Domain Admins via: Group:Enterprise Admins -> User:jbumrah -> Group:Domain Admins
Administrators → Enterprise Admins → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 0
Authorities Gained: Administrators
Group:Administrators can use has_WriteDACL_on on Group:Enterprise Admins to gain access to Domain Admins via: Group:Administrators -> Group:Enterprise Admins -> Group:Domain Admins
Enterprise Admins → Administrators → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 0
Authorities Gained: Enterprise Admins
Group:Enterprise Admins can use has_WriteDACL_on on Group:Administrators to gain access to Domain Admins via: Group:Enterprise Admins -> Group:Administrators -> Group:Domain Admins
Account Operators → Cert Publishers → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: GenericAll
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Account Operators
Group:Account Operators can use has_GenericAll_on on Group:Cert Publishers to gain access to Domain Admins via: Group:Account Operators -> Group:Cert Publishers -> Group:Domain Admins
Account Operators → Terminal Server License Servers → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: GenericAll
Chain: 3 hops
Source Proximity: prox: 0
Target Proximity: prox: 1
Authorities Gained: Account Operators
Group:Account Operators can use has_GenericAll_on on Group:Terminal Server License Servers to gain access to Domain Admins via: Group:Account Operators -> Group:Terminal Server License Servers -> Group:Domain Admins
Account Operators → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: GenericAll
Chain: 4 hops
Source Proximity: prox: 0
Target Proximity: prox: 2
Authorities Gained: Account Operators
Group:Account Operators can use has_GenericAll_on on User:mdsiraj to gain access to Domain Admins via: Group:Account Operators -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Administrators → Account Operators → Cert Publishers → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner
Chain: 4 hops
Source Proximity: prox: 0
Target Proximity: prox: 0
Authorities Gained: Administrators
Group:Administrators can use has_WriteDACL_on on Group:Account Operators to gain access to Domain Admins via: Group:Administrators -> Group:Account Operators -> Group:Cert Publishers -> Group:Domain Admins
Enterprise Admins → Account Operators → Cert Publishers → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner
Chain: 4 hops
Source Proximity: prox: 0
Target Proximity: prox: 0
Authorities Gained: Enterprise Admins
Group:Enterprise Admins can use has_WriteDACL_on on Group:Account Operators to gain access to Domain Admins via: Group:Enterprise Admins -> Group:Account Operators -> Group:Cert Publishers -> Group:Domain Admins
Account Operators → rashwin → Director → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: GenericAll
Chain: 4 hops
Source Proximity: prox: 0
Target Proximity: prox: 2
Authorities Gained: Account Operators
Group:Account Operators can use has_GenericAll_on on User:rashwin to gain access to Domain Admins via: Group:Account Operators -> User:rashwin -> Group:Director -> Group:Domain Admins
Account Operators → rsharma → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: GenericAll
Chain: 5 hops
Source Proximity: prox: 0
Target Proximity: prox: 3
Authorities Gained: Account Operators
Group:Account Operators can use has_GenericAll_on on User:rsharma to gain access to Domain Admins via: Group:Account Operators -> User:rsharma -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Account Operators → rjadeja → rsharma → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: GenericAll
Chain: 6 hops
Source Proximity: prox: 0
Target Proximity: prox: 4
Authorities Gained: Account Operators
Group:Account Operators can use has_GenericAll_on on User:rjadeja to gain access to Domain Admins via: Group:Account Operators -> User:rjadeja -> User:rsharma -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Cert Publishers → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 2 hops
Source Proximity: prox: 1
Target Proximity: prox: 0
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on Group:Domain Admins to gain access to Domain Admins via: Group:Cert Publishers -> Group:Domain Admins
Terminal Server License Servers → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 2 hops
Source Proximity: prox: 1
Target Proximity: prox: 0
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on Group:Domain Admins to gain access to Domain Admins via: Group:Terminal Server License Servers -> Group:Domain Admins
Cert Publishers → Director → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 1
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on Group:Director to gain access to Domain Admins via: Group:Cert Publishers -> Group:Director -> Group:Domain Admins
Terminal Server License Servers → Director → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 1
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on Group:Director to gain access to Domain Admins via: Group:Terminal Server License Servers -> Group:Director -> Group:Domain Admins
Cert Publishers → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 1
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on User:vkohli to gain access to Domain Admins via: Group:Cert Publishers -> User:vkohli -> Group:Domain Admins
Terminal Server License Servers → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 1
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on User:vkohli to gain access to Domain Admins via: Group:Terminal Server License Servers -> User:vkohli -> Group:Domain Admins
Cert Publishers → Administrator → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 1
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on User:Administrator to gain access to Domain Admins via: Group:Cert Publishers -> User:Administrator -> Group:Domain Admins
Terminal Server License Servers → Administrator → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 1
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on User:Administrator to gain access to Domain Admins via: Group:Terminal Server License Servers -> User:Administrator -> Group:Domain Admins
Cert Publishers → jbumrah → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 1
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on User:jbumrah to gain access to Domain Admins via: Group:Cert Publishers -> User:jbumrah -> Group:Domain Admins
Terminal Server License Servers → jbumrah → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 1
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on User:jbumrah to gain access to Domain Admins via: Group:Terminal Server License Servers -> User:jbumrah -> Group:Domain Admins
Cert Publishers → Enterprise Admins → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 0
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on Group:Enterprise Admins to gain access to Domain Admins via: Group:Cert Publishers -> Group:Enterprise Admins -> Group:Domain Admins
Terminal Server License Servers → Enterprise Admins → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 0
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on Group:Enterprise Admins to gain access to Domain Admins via: Group:Terminal Server License Servers -> Group:Enterprise Admins -> Group:Domain Admins
Cert Publishers → Administrators → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 0
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on Group:Administrators to gain access to Domain Admins via: Group:Cert Publishers -> Group:Administrators -> Group:Domain Admins
Terminal Server License Servers → Administrators → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 1
Target Proximity: prox: 0
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on Group:Administrators to gain access to Domain Admins via: Group:Terminal Server License Servers -> Group:Administrators -> Group:Domain Admins
Cert Publishers → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 4 hops
Source Proximity: prox: 1
Target Proximity: prox: 2
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on User:mdsiraj to gain access to Domain Admins via: Group:Cert Publishers -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Terminal Server License Servers → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 4 hops
Source Proximity: prox: 1
Target Proximity: prox: 2
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on User:mdsiraj to gain access to Domain Admins via: Group:Terminal Server License Servers -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Cert Publishers → Account Operators → Cert Publishers → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 4 hops
Source Proximity: prox: 1
Target Proximity: prox: 0
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on Group:Account Operators to gain access to Domain Admins via: Group:Cert Publishers -> Group:Account Operators -> Group:Cert Publishers -> Group:Domain Admins
Terminal Server License Servers → Account Operators → Cert Publishers → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 4 hops
Source Proximity: prox: 1
Target Proximity: prox: 0
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on Group:Account Operators to gain access to Domain Admins via: Group:Terminal Server License Servers -> Group:Account Operators -> Group:Cert Publishers -> Group:Domain Admins
Cert Publishers → rashwin → Director → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 4 hops
Source Proximity: prox: 1
Target Proximity: prox: 2
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on User:rashwin to gain access to Domain Admins via: Group:Cert Publishers -> User:rashwin -> Group:Director -> Group:Domain Admins
Terminal Server License Servers → rashwin → Director → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 4 hops
Source Proximity: prox: 1
Target Proximity: prox: 2
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on User:rashwin to gain access to Domain Admins via: Group:Terminal Server License Servers -> User:rashwin -> Group:Director -> Group:Domain Admins
Cert Publishers → rsharma → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 5 hops
Source Proximity: prox: 1
Target Proximity: prox: 3
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on User:rsharma to gain access to Domain Admins via: Group:Cert Publishers -> User:rsharma -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Terminal Server License Servers → rsharma → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 5 hops
Source Proximity: prox: 1
Target Proximity: prox: 3
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on User:rsharma to gain access to Domain Admins via: Group:Terminal Server License Servers -> User:rsharma -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Cert Publishers → rjadeja → rsharma → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 6 hops
Source Proximity: prox: 1
Target Proximity: prox: 4
Authorities Gained: Cert Publishers
Group:Cert Publishers can use has_WriteProperty_on on User:rjadeja to gain access to Domain Admins via: Group:Cert Publishers -> User:rjadeja -> User:rsharma -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Terminal Server License Servers → rjadeja → rsharma → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 6 hops
Source Proximity: prox: 1
Target Proximity: prox: 4
Authorities Gained: Terminal Server License Servers
Group:Terminal Server License Servers can use has_WriteProperty_on on User:rjadeja to gain access to Domain Admins via: Group:Terminal Server License Servers -> User:rjadeja -> User:rsharma -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
rashwin → Director → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ReadProperty, WriteProperty
Chain: 3 hops
Source Proximity: prox: 2
Target Proximity: prox: 1
User:rashwin can use has_WriteProperty_on on Group:Director to gain access to Domain Admins via: User:rashwin -> Group:Director -> Group:Domain Admins
mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ExtendedRight
Chain: 3 hops
Source Proximity: prox: 2
Target Proximity: prox: 1
User:mdsiraj can use ResetPassword on User:vkohli to gain access to Domain Admins via: User:mdsiraj -> User:vkohli -> Group:Domain Admins
rsharma → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: WriteDacl
Chain: 4 hops
Source Proximity: prox: 3
Target Proximity: prox: 2
User:rsharma can use has_WriteDACL_on on User:mdsiraj to gain access to Domain Admins via: User:rsharma -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
rjadeja → rsharma → mdsiraj → vkohli → Domain Admins
0.0
LOW
BLUES.LOCAL // (Domain Root) -> BLUES.LOCAL // (Domain Root)
Permission: ExtendedRight
Chain: 5 hops
Source Proximity: prox: 4
Target Proximity: prox: 3
User:rjadeja can use ResetPassword on User:rsharma to gain access to Domain Admins via: User:rjadeja -> User:rsharma -> User:mdsiraj -> User:vkohli -> Group:Domain Admins
Domain Admin Privilege Paths 7 identities
IdentityShortest PathPaths HopsProxOUBFS
Administrator Administrator → Domain Admins 353 2 1 BLUES.LOCAL // (Domain Root) ✓
vkohli vkohli → Domain Admins 105 2 1 BLUES.LOCAL // (Domain Root) ✓
jbumrah jbumrah → Domain Admins 182 2 1 BLUES.LOCAL // (Domain Root) ✓
rashwin rashwin → Director → Domain Admins 73 3 2 BLUES.LOCAL // (Domain Root) ✓
mdsiraj mdsiraj → vkohli → Domain Admins 105 3 2 BLUES.LOCAL // (Domain Root) ✓
rsharma rsharma → mdsiraj → vkohli → Domain Admins 105 4 3 BLUES.LOCAL // (Domain Root) ✓
rjadeja rjadeja → rsharma → mdsiraj → vkohli → Domain Admins 95 5 4 BLUES.LOCAL // (Domain Root) ✓
Kerberoastable Identities 3 identities  ·  0 high-priority
rsharma MEDIUM DA PATH ENABLED prox: 3
HTTP/hr-app.blues.local
OU: BLUES.LOCAL // (Domain Root) SPN Count: 1 DA Paths: 105
krbtgt MEDIUM NO DA PATH DISABLED prox: —
kadmin/changepw
OU: BLUES.LOCAL // (Domain Root) SPN Count: 1 DA Paths: 0
BLUES-DC$ MEDIUM NO DA PATH ENABLED prox: —
Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/Blues-DC.Blues.localldap/Blues-DC.Blues.local/ForestDnsZones.Blues.localldap/Blues-DC.Blues.local/DomainDnsZones.Blues.localDNS/Blues-DC.Blues.localGC/Blues-DC.Blues.local/Blues.localRPC/2e7cb30a-bcf3-4cf2-9285-5dcf28936f2b._msdcs.Blues.localE3514235-4B06-11D1-AB04-00C04FC2DCD2/2e7cb30a-bcf3-4cf2-9285-5dcf28936f2b/Blues.localldap/BLUES-DC/BLUESldap/2e7cb30a-bcf3-4cf2-9285-5dcf28936f2b._msdcs.Blues.localldap/Blues-DC.Blues.local/BLUESldap/BLUES-DCldap/Blues-DC.Blues.localldap/Blues-DC.Blues.local/Blues.local
OU: BLUES.LOCAL // Domain Controllers SPN Count: 13 DA Paths: 0
Delegation Risks 1
BLUES-DC$ → * MEDIUM unconstrained
Conditions: target_authenticates, forwardable_ticket OU Direction: BLUES.LOCAL // Domain Controllers -> BLUES.LOCAL // (Domain Root) Source Prox: None
Graph Explorer 12 nodes  ·  9 edges
User
Group
Computer
SPN
 Critical ACL
 Membership
Drag nodes  ·  Scroll to zoom  ·  Pan on canvas  ·  Hover for details