User Guide

Global Arguments

$ bloodyAD -h

usage: bloodyAD [-h] [-d DOMAIN] [-u USERNAME] [-p PASSWORD]
                [-k [KERBEROS ...]] [-f {b64,hex,aes,rc4,default}]
                [-c [CERTIFICATE]] [-s] -H HOST [-i DC_IP] [--dns DNS]
                [-t TIMEOUT] [--gc] [-v {QUIET,INFO,DEBUG,TRACE}] [--json]
                {add,get,remove,set} ...

AD Privesc Swiss Army Knife

options:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        Domain used for NTLM authentication
  -u USERNAME, --username USERNAME
                        Username used for NTLM authentication
  -p PASSWORD, --password PASSWORD
                        password or LMHASH:NTHASH for NTLM authentication,
                        password or AES/RC4 key for kerberos, password for
                        certificate (Do not specify to trigger integrated
                        windows authentication)
  -k [KERBEROS ...], --kerberos [KERBEROS ...]
                        Enable Kerberos authentication. If '-p' is provided it
                        will try to query a TGT with it. You can also provide
                        a list of one or more optional keywords as '-k
                        kdc=192.168.100.1 kdcc=192.168.150.1
                        realmc=foreign.realm.corp
                        <keyfile_type>=/home/silver/Admin.ccache',
                        <keyfile_type> being ccache, kirbi or keytab, 'kdc'
                        being the kerberos server for the keyfile provided and
                        'realmc' and 'kdcc' for cross realm (the realm of the
                        '--host' provided)
  -f {b64,hex,aes,rc4,default}, --format {b64,hex,aes,rc4,default}
                        Specify format for '--password' or '-k <keyfile>'
  -c [CERTIFICATE], --certificate [CERTIFICATE]
                        Schannel authentication or krb pkinit if -k also
                        provided, e.g: "path/to/key:path/to/cert" (Use Windows
                        Certstore with krb if left empty)
  -s, --secure          Use LDAP/GC over TLS (LDAPS/GCS). Use -ss to remove
                        all encryption/signing (useful for debug).
  -H HOST, --host HOST  Hostname or IP of the DC (ex: my.dc.local or
                        172.16.1.3)
  -i DC_IP, --dc-ip DC_IP
                        IP of the DC (useful if you provided a --host which
                        can't resolve)
  --dns DNS             IP of the DNS to resolve AD names (useful for inter-
                        domain functions)
  -t TIMEOUT, --timeout TIMEOUT
                        Connection timeout in seconds
  --gc                  Connect to Global Catalog (GC)
  -v {QUIET,INFO,DEBUG,TRACE}, --verbose {QUIET,INFO,DEBUG,TRACE}
                        Adjust output verbosity
  --json                Output results in JSON format

Commands:
  {add,get,remove,set}
    add                 [ADD] function category
    get                 [GET] function category
    remove              [REMOVE] function category
    set                 [SET] function category

Commands Arguments

add Commands

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add -h

usage: bloodyAD add [-h]
                    {badSuccessor,computer,dcsync,dnsRecord,genericAll,groupMember,rbcd,shadowCredentials,uac,user}
                    ...

options:
  -h, --help            show this help message and exit

add commands:
  {badSuccessor,computer,dcsync,dnsRecord,genericAll,groupMember,rbcd,shadowCredentials,uac,user}
    badSuccessor        Add a new DMSA (Dedicated Managed Service Account)
                        object
    computer            Add new computer
    dcsync              Add DCSync right on domain to provided trustee
                        (Requires to own or to have WriteDacl on domain
                        object)
    dnsRecord           This function adds a new DNS record into an AD
                        environment.
    genericAll          Give full control to trustee on target and descendants
                        (you must own the object or have WriteDacl)
    groupMember         Add a new member (user, group, computer) to group
    rbcd                Add Resource Based Constraint Delegation for service
                        on target, used to impersonate a user on target with
                        service (Requires "Write" permission on target's msDS-
                        AllowedToActOnBehalfOfOtherIdentity and Windows Server
                        >= 2012)
    shadowCredentials   Add Key Credentials to target (try to find a suitable
                        DC if provided DC is below Win2016), and use those
                        credentials to retrieve a TGT and a NT hash using
                        PKINIT.
    uac                 Add property flags altering user/computer object
                        behavior
    user                Add a new user

add badSuccessor

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add badSuccessor -h

usage: bloodyAD add badSuccessor [-h] [-t T] [--ou OU] dmsa

positional arguments:
  dmsa        hostname of the DMSA object (no need to add '$')

options:
  -h, --help  show this help message and exit
  -t T        Distinguished Name of the target whose privileges are to be
              assumed (can be called multiple times, e.g. "-t
              CN=Admin,CN=Users,DC=domain,DC=com -t
              CN=John,CN=Users,DC=domain,DC=com") (default:
              ['CN=Administrator,CN=Users,DC=Current,DC=Domain'])
  --ou OU     Organizational Unit for the DMSA object. If not provided,
              chooses the first OU the logged user can add child to. (default:
              None)

add computer

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add computer -h

usage: bloodyAD add computer [-h] [--ou OU] [--lifetime LIFETIME]
                             hostname newpass

positional arguments:
  hostname             computer name (without trailing $)
  newpass              password for computer

options:
  -h, --help           show this help message and exit
  --ou OU              Organizational Unit for computer (default: DefaultOU)
  --lifetime LIFETIME  lifetime of new computer in seconds, if non-zero
                       creates it as a dynamic object (default: 0)

Tip

Make sure to provide the domain FQDN as domain global argument -d bloody.lab or you will run into an issue as problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9026b (dNSHostName)

add dcsync

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add dcsync -h

usage: bloodyAD add dcsync [-h] trustee

positional arguments:
  trustee     sAMAccountName, DN or SID of the trustee

options:
  -h, --help  show this help message and exit

add dnsRecord

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add dnsRecord -h

usage: bloodyAD add dnsRecord [-h] [--dnstype {A,AAAA,CNAME,MX,PTR,SRV,TXT}]
                              [--zone ZONE] [--ttl TTL]
                              [--preference PREFERENCE] [--port PORT]
                              [--priority PRIORITY] [--weight WEIGHT]
                              [--forest]
                              name data

positional arguments:
  name                  name of the dnsNode object (hostname) which will
                        contain the new record
  data                  DNS record data, for most record types this will be
                        the destination hostname or IP address, for TXT
                        records this can be used for text

options:
  -h, --help            show this help message and exit
  --dnstype {A,AAAA,CNAME,MX,PTR,SRV,TXT}
                        DNS record type (default: A)
  --zone ZONE           DNS zone (default: CurrentDomain)
  --ttl TTL             DNS record TTL, time in seconds the record stays in
                        DNS caches, must be low if you want to propagate
                        record updates quickly (default: 300)
  --preference PREFERENCE
                        DNS MX record preference, must be lower than the
                        concurrent records to be chosen (default: 10)
  --port PORT           listening port of the service in a DNS SRV record
                        (default: None)
  --priority PRIORITY   priority of a DNS SRV record against concurrent, must
                        be lower to be chosen, if identical to others, highest
                        weight will be chosen (default: 10)
  --weight WEIGHT       weight of a DNS SRV record against concurrent, must be
                        higher with the lowest priority to be chosen (default:
                        60)
  --forest              if set, registers dns record in forest instead of
                        domain (default: False)

Simplest usage:

$ bloodyAD --host 10.1.0.4 -u bloodyAdmin -p 'Password123!' -d bloody add dnsRecord test.bloody.local 8.8.8.8

add genericAll

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add genericAll -h

usage: bloodyAD add genericAll [-h] target trustee

positional arguments:
  target      sAMAccountName, DN or SID of the target
  trustee     sAMAccountName, DN or SID of the trustee which will have full
              control on target

options:
  -h, --help  show this help message and exit

add groupMember

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add groupMember -h

usage: bloodyAD add groupMember [-h] group member

positional arguments:
  group       sAMAccountName, DN or SID of the group
  member      sAMAccountName, DN or SID of the member

options:
  -h, --help  show this help message and exit

Note

Support Foreign Users

add rbcd

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add rbcd -h

usage: bloodyAD add rbcd [-h] target service

positional arguments:
  target      sAMAccountName, DN or SID of the target
  service     sAMAccountName, DN or SID of the service account

options:
  -h, --help  show this help message and exit

add shadowCredentials

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add shadowCredentials -h

usage: bloodyAD add shadowCredentials [-h] [--path PATH] target

positional arguments:
  target       sAMAccountName, DN or SID of the target

options:
  -h, --help   show this help message and exit
  --path PATH  filepath for the generated credentials (TGT ccache or pfx if
               PKINIT fails) (default: CurrentPath)

Warning

• DC must run at least Windows Server 2016 (msDS-KeyCredentialLink only available since 2016 AD Schema), to verify:
  • query the RootDSE of the DC get object '' and verify domainControllerFunctionality is 7 or above
  • or the nTDSDSA of the DC e.g.: get object CN=NTDS Settings,CN=ALLMIGHTY,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=bloody,DC=lab --attr msDS-Behavior-Version
• Be in a domain where the DC has AD CS enabled or a certificate authority set up in order for the PKINIT to work

add uac

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add uac -h

usage: bloodyAD add uac [-h] [-f F] target

positional arguments:
  target      sAMAccountName, DN or SID of the target

options:
  -h, --help  show this help message and exit
  -f F        name of property flag to add, can be called multiple times if
              multiple flags to add (e.g -f DONT_REQ_PREAUTH -f
              DONT_EXPIRE_PASSWORD) (default: None)

add user

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass add user -h

usage: bloodyAD add user [-h] [--ou OU] [--lifetime LIFETIME]
                         sAMAccountName newpass

positional arguments:
  sAMAccountName       sAMAccountName for new user
  newpass              password for new user

options:
  -h, --help           show this help message and exit
  --ou OU              Organizational Unit for new user (default: DefaultOU)
  --lifetime LIFETIME  lifetime of new user in seconds, if non-zero creates it
                       as a dynamic object (default: 0)

get Commands

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get -h

usage: bloodyAD get [-h]
                    {bloodhound,children,dnsDump,membership,object,search,trusts,writable}
                    ...

options:
  -h, --help            show this help message and exit

get commands:
  {bloodhound,children,dnsDump,membership,object,search,trusts,writable}
    bloodhound          BloodHound CE collector (WARNING: This script is still
                        in development. It only provides the basics - ADCS ESC
                        and other complex nodes aren't supported yet)
    children            List children for a given target object
    dnsDump             Retrieve DNS records of the Active Directory
                        readable/listable by the user
    membership          Retrieve SID and SAM Account Names of all groups a
                        target belongs to
    object              Retrieve LDAP attributes for the target object
                        provided, binary data will be outputted in base64
    search              Search in LDAP database, binary data will be outputted
                        in base64
    trusts              Display trusts in an ascii tree starting from the DC
                        domain as tree root. A->B means A can auth on B and
                        A-<B means B can auth on A, A-<>B means bidirectional
    writable            Retrieve objects writable by client

get bloodhound

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get bloodhound -h

usage: bloodyAD get bloodhound [-h] [--transitive] [--path PATH]

options:
  -h, --help    show this help message and exit
  --transitive  if set, will try to reach trusts to have more complete results
                (you should start from a dc of your user domain to have more
                complete results) (default: False)
  --path PATH   filepath for the generated zip file (default: CurrentPath)

get children

List children for a given target object:

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get children -h

usage: bloodyAD get children [-h] [--target TARGET] [--otype OTYPE] [--direct]

options:
  -h, --help       show this help message and exit
  --target TARGET  sAMAccountName, DN or SID of the target (default: DOMAIN)
  --otype OTYPE    special keyword "useronly" or objectClass of objects to
                   fetch e.g. user, computer, group, trustedDomain,
                   organizationalUnit, container, groupPolicyContainer, msDS-
                   GroupManagedServiceAccount, etc (default: *)
  --direct         Fetch only direct children of target (default: False)

get dnsDump

Retrieve DNS records of the Active Directory readable/listable by the user:

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get dnsDump -h

usage: bloodyAD get dnsDump [-h] [--zone ZONE] [--no-detail] [--transitive]

options:
  -h, --help    show this help message and exit
  --zone ZONE   if set, prints only records in this zone (default: None)
  --no-detail   if set doesn't include system records such as _ldap,
                _kerberos, @, etc (default: False)
  --transitive  if set, try to fetch dns records in AD trusts (you should
                start from a DC of your user domain to have exhaustive
                results) (default: False)

--zone can be used e.g. to display only our domain zone --zone bloody.local

get membership

Retrieve SID and SAM Account Names of all groups a target belongs to:

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get membership -h

usage: bloodyAD get membership [-h] [--no-recurse] target

positional arguments:
  target        sAMAccountName, DN or SID of the target

options:
  -h, --help    show this help message and exit
  --no-recurse  if set, doesn't retrieve groups where target isn't a direct
                member (default: False)

If --no-recurse is set, and our target john belongs to a group printer admins which belongs to Domain Admins, Domain Admins will not be displayed in the result.

get object

Retrieve LDAP attributes for the target object provided, binary data will be outputted in base64:

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get object -h

usage: bloodyAD get object [-h] [--attr ATTR] [--resolve-sd] [--raw]
                           [--transitive]
                           target

positional arguments:
  target        sAMAccountName, DN or SID of the target (if you give an empty
                string "" prints rootDSE)

options:
  -h, --help    show this help message and exit
  --attr ATTR   attributes to retrieve separated by a comma, retrieves all the
                attributes by default (default: *)
  --resolve-sd  if set, permissions linked to a security descriptor will be
                resolved (see bloodyAD github wiki/Access-Control for more
                information) (default: False)
  --raw         if set, will return attributes as sent by the server without
                any formatting, binary data will be outputted in base64
                (default: False)
  --transitive  if set with "--resolve-sd", will try to resolve foreign SID by
                reaching trusts (default: False)

Examples:

# Get group members
bloodyAD -u john.doe -d bloody -p Password512! --host 192.168.10.2 get object "Domain Admins" --attr member # Get UserAccountControl flags

# Get User account controls (e.g. see if user is locked)
bloodyAD -u Administrator -d bloody -p Password512! --host 192.168.10.2 get object john.doe --attr userAccountControl

# Read GMSA account password
bloodyAD -u john.doe -d bloody -p Password512 --host 192.168.10.2 get object 'gmsaAccount$' --attr msDS-ManagedPassword

# Read LAPS password
bloodyAD -u john.doe -d bloody -p Password512 --host 192.168.10.2 get object 'COMPUTER$' --attr ms-Mcs-AdmPwd

get search

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get search -h

usage: bloodyAD get search [-h] [--base BASE] [--filter FILTER] [--attr ATTR]
                           [--resolve-sd] [--raw] [--transitive] [-c C]

options:
  -h, --help       show this help message and exit
  --base BASE      DN of the parent object (default: DOMAIN)
  --filter FILTER  filter to apply to the LDAP search (see Microsoft LDAP
                   filter syntax) (default: (objectClass=*))
  --attr ATTR      attributes to retrieve separated by a comma (default: *)
  --resolve-sd     if set, permissions linked to a security descriptor will be
                   resolved (see bloodyAD github wiki/Access-Control for more
                   information) (default: False)
  --raw            if set, will return attributes as sent by the server
                   without any formatting, binary data will be outputed in
                   base64 (default: False)
  --transitive     if set with "--resolve-sd", will try to resolve foreign SID
                   by reaching trusts (default: False)
  -c C             if set, will use the controls for extended search
                   operations, e.g. "-c 1.2.840.113556.1.4.2064 -c
                   1.2.840.113556.1.4.2065" to display tombstoned, deleted and
                   recycled objects and their linked attributes (default: [])

Note

You can filter by binary attributes by giving escaped bytes of data, e.g.: get search --filter '(attributeSecurityGuid=b\BC\05X\C9\BD\28D\A5\E2\85j\0FL\18\5E)' --attr=ldapDisplayName --base CN=Schema,CN=Configuration,DC=BLOODY,DC=LAB

get trusts

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get trusts -h

usage: bloodyAD get trusts [-h] [--transitive]

options:
  -h, --help    show this help message and exit
  --transitive  Try to fetch transitive trusts (you should start from a dc of
                your user domain to have more complete results) (default:
                False)

get writable

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass get writable -h

usage: bloodyAD get writable [-h]
                             [--otype {ALL,OU,USER,COMPUTER,GROUP,DOMAIN,GPO}]
                             [--right {ALL,WRITE,CHILD}] [--detail]
                             [--include-del]

options:
  -h, --help            show this help message and exit
  --otype {ALL,OU,USER,COMPUTER,GROUP,DOMAIN,GPO}
                        type of writable object to retrieve (default: ALL)
  --right {ALL,WRITE,CHILD}
                        type of right to search (default: ALL)
  --detail              if set, displays attributes/object types you can
                        write/create for the object (default: False)
  --include-del         if set, include deleted objects (default: False)

remove Commands

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove -h

usage: bloodyAD remove [-h]
                       {dcsync,dnsRecord,genericAll,groupMember,object,rbcd,shadowCredentials,uac}
                       ...

options:
  -h, --help            show this help message and exit

remove commands:
  {dcsync,dnsRecord,genericAll,groupMember,object,rbcd,shadowCredentials,uac}
    dcsync              Remove DCSync right for provided trustee
    dnsRecord           Remove a DNS record of an AD environment.
    genericAll          Remove full control of trustee on target
    groupMember         Remove member (user, group, computer) from group
    object              Remove object (user, group, computer, organizational
                        unit, etc)
    rbcd                Remove Resource Based Constraint Delegation for
                        service on target
    shadowCredentials   Remove Key Credentials from target
    uac                 Remove property flags altering user/computer object
                        behavior

remove dcsync

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove dcsync -h

usage: bloodyAD remove dcsync [-h] trustee

positional arguments:
  trustee     sAMAccountName, DN or SID of the trustee

options:
  -h, --help  show this help message and exit

remove dnsRecord

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove dnsRecord -h

usage: bloodyAD remove dnsRecord [-h]
                                 [--dnstype {A,AAAA,CNAME,MX,PTR,SRV,TXT}]
                                 [--zone ZONE] [--ttl TTL]
                                 [--preference PREFERENCE] [--port PORT]
                                 [--priority PRIORITY] [--weight WEIGHT]
                                 [--forest]
                                 name data

positional arguments:
  name                  name of the dnsNode object (hostname) which contains
                        the record
  data                  DNS record data

options:
  -h, --help            show this help message and exit
  --dnstype {A,AAAA,CNAME,MX,PTR,SRV,TXT}
                        DNS record type (default: A)
  --zone ZONE           DNS zone (default: CurrentDomain)
  --ttl TTL             DNS record TTL (default: None)
  --preference PREFERENCE
                        DNS MX record preference (default: None)
  --port PORT           listening port of the service in a DNS SRV record
                        (default: None)
  --priority PRIORITY   priority of a DNS SRV record against concurrent
                        (default: None)
  --weight WEIGHT       weight of a DNS SRV record against concurrent
                        (default: None)
  --forest              if set, will fetch the dns record in forest instead of
                        domain (default: False)

The options must be used if:

• The record is not an A type (you must provide other options depending of the type but TTL is always optional)
• The record is not in the DOMAIN zone
• The record is in the Forest DNS Partition and Not the Domain DNS Partition Simplest usage:

$ bloodyAD --host 10.1.0.4 -u bloodyAdmin -p 'Password123!' -d bloody remove dnsRecord test.bloody.local 8.8.8.8

remove genericAll

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove genericAll -h

usage: bloodyAD remove genericAll [-h] target trustee

positional arguments:
  target      sAMAccountName, DN or SID of the target
  trustee     sAMAccountName, DN or SID of the trustee

options:
  -h, --help  show this help message and exit

remove groupMember

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove groupMember -h

usage: bloodyAD remove groupMember [-h] group member

positional arguments:
  group       sAMAccountName, DN or SID of the group
  member      sAMAccountName, DN or SID of the member

options:
  -h, --help  show this help message and exit

remove object

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove object -h

usage: bloodyAD remove object [-h] target

positional arguments:
  target      sAMAccountName, DN or SID of the target

options:
  -h, --help  show this help message and exit

remove rbcd

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove rbcd -h

usage: bloodyAD remove rbcd [-h] target service

positional arguments:
  target      sAMAccountName, DN or SID of the target
  service     sAMAccountName, DN or SID of the service account

options:
  -h, --help  show this help message and exit

remove shadowCredentials

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove shadowCredentials -h

usage: bloodyAD remove shadowCredentials [-h] [--key KEY] target

positional arguments:
  target      sAMAccountName, DN or SID of the target

options:
  -h, --help  show this help message and exit
  --key KEY   RSA key of Key Credentials to remove from the target, removes
              all if key not specified (default: None)

remove uac

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass remove uac -h

usage: bloodyAD remove uac [-h] [-f F] target

positional arguments:
  target      sAMAccountName, DN or SID of the target

options:
  -h, --help  show this help message and exit
  -f F        name of property flag to remove, can be called multiple times if
              multiple flags to remove (e.g -f LOCKOUT -f ACCOUNTDISABLE)
              (default: None)

set Commands

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass set -h

usage: bloodyAD set [-h] {object,owner,password,restore} ...

options:
  -h, --help            show this help message and exit

set commands:
  {object,owner,password,restore}
    object              Add/Replace/Delete target's attribute
    owner               Changes target ownership with provided owner
                        (WriteOwner permission required)
    password            Change password of a user/computer
    restore             Restore a deleted object

set object

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass set object -h

usage: bloodyAD set object [-h] [-v V] [--raw] [--b64] target attribute

positional arguments:
  target      sAMAccountName, DN or SID of the target
  attribute   name of the attribute

options:
  -h, --help  show this help message and exit
  -v V        add value if attribute doesn't exist, replace value if attribute
              exists, delete if no value given, can be called multiple times
              if multiple values to set (e.g -v HOST/janettePC -v
              HOST/janettePC.bloody.local) (default: [])
  --raw       if set, will try to send the values provided as is, without any
              encoding (default: False)
  --b64       expect base64 values in -v (available only with --raw) (default:
              False)

set owner

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass set owner -h

usage: bloodyAD set owner [-h] target owner

positional arguments:
  target      sAMAccountName, DN or SID of the target
  owner       sAMAccountName, DN or SID of the new owner

options:
  -h, --help  show this help message and exit

Warning

If you only have WRITE_OWNER or SE_TAKE_OWNERSHIP_PRIVILEGE, you can only set yourself as owner. You must have DS-Set-Owner on the domain or SeRestorePrivilege to set any other users as owners (see [MS-ADTS] 6.1.3.5 and this article)

set password

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass set password -h

usage: bloodyAD set password [-h] [--oldpass OLDPASS] target newpass

positional arguments:
  target             sAMAccountName, DN or SID of the target
  newpass            new password for the target

options:
  -h, --help         show this help message and exit
  --oldpass OLDPASS  old password of the target, mandatory if you don't have
                     "change password" permission on the target (default:
                     None)

Note

You can use oldpass to change the password of another user without having any special right on it. (Useful when the target is locked because the password is expired)

set restore

$ bloodyAD -H 10.10.10.10 -d bloody -u admin -p pass set restore -h

usage: bloodyAD set restore [-h] [--newName NEWNAME] [--newParent NEWPARENT]
                            target

positional arguments:
  target                sAMAccountName (or name for GPO) or SID of the target
                        (shouldn't be sAMAccountName if there is a duplicate)

options:
  -h, --help            show this help message and exit
  --newName NEWNAME     new name for the restored object (update also
                        sAMAccountName, UPN, SPN...), if not provided will use
                        the last known RDN (default: None)
  --newParent NEWPARENT
                        new parent for the restored object, if not provided
                        will use the last known parent (default: None)