Impacket dacledit.py

Back to the Category Index / Back to the Command Index

Overview

Reads an LDAP object’s DACL and adds, removes, or restores ACEs. Targets can be specified by name, SID, or DN.

Item	Details
Implementation	`examples/dacledit.py`
Category	Active Directory / LDAP / Account Management
Size	779 lines
Distribution	Installed as a script through `scripts=examples/*.py` in `setup.py`

CLI and Inputs

Check python examples/dacledit.py -h for the current option definitions.

Argument	Description
`identity`	`domain.local/username[:password]`
`-ldaps / -use-ldaps`	Use LDAPS instead of LDAP.
`-ts`	Add timestamps to log output.
`-debug`	Enable debug logging.
`-hashes`	NTLM hashes in `LMHASH:NTHASH` format.
`-no-pass`	Skip the password prompt (useful with `-k`).
`-k`	Use Kerberos authentication. Read credentials from the ccache (`KRB5CCNAME`) based on the target; fall back to command-line credentials if none are valid.
`-aesKey`	128- or 256-bit AES key for Kerberos authentication.
`-dc-ip`	IP address of the domain controller or KDC for Kerberos. Defaults to the domain (FQDN) in `identity`.
`-dc-host`	Hostname of the domain controller or KDC for Kerberos. Uses `-dc-ip` if omitted.
`-principal`	Principal `sAMAccountName`.
`-principal-sid`	Principal security identifier.
`-principal-dn`	Principal distinguished name.
`-target`	Target `sAMAccountName`.
`-target-sid`	Target security identifier.
`-target-dn`	Target distinguished name.
`-action`	DACL operation. Choices: read, write, remove, backup, restore. Default: read.
`-file`	File path; optional for `-action backup` and required for restore.
`-ace-type`	ACE type to add or remove. Choices: allowed, denied. Default: allowed.
`-rights`	Rights to add or remove from the target DACL. Choices: FullControl, ResetPassword, WriteMembers, DCSync, Custom. Default: FullControl.
`-rights-guid`	GUID of the right to add or remove.
`-mask`	Access mask: readwrite, write, self, allext, or `0xXXXXX`. Useful with `-rights Custom` or `-rights-guid` when the mask differs from read+write.
`-inheritance`	Set `CONTAINER_INHERIT_ACE` and `OBJECT_INHERIT_ACE` in the ACE flags. For a container or OU, child objects inherit the ACE except those with `adminCount=1`.

Related technology: LDAP and AD Security Descriptors covers ACE types, GUIDs, and SD controls. impacket.acl is not used.

Detailed Processing Flow

After LDAP bind, the command resolves the target DN and principal SID, then retrieves the descriptor with a security descriptor control. read parses and displays ACEs; write / remove build or change ACEs from rights and inheritance, then perform LDAP modify. The original descriptor can be saved as backup JSON and restored with restore.

How It Works

An LDAP object’s DACL is an ordered sequence of ACEs, not simply a set of permission names. The command retrieves the binary descriptor using a security descriptor control and breaks each ACE into its type, trustee SID, access mask, object GUID, and inheritance flags. read maps this structure to human-readable permissions.

write expands higher-level selections such as FullControl and DCSync into one or more ACEs and GUIDs/masks, then appends them to the existing DACL. remove deletes only ACEs matching the same conditions. For object-specific ACEs, the GUID and mask combination matters; an ACE must not be removed merely because its SID matches. Inheritance changes the scope across the container and its child objects.

backup / restore store the original binary descriptor in JSON, not the displayed result, so unknown ACEs and their order can be restored. Changes must preserve canonical ACE order, descriptor control flags, and untargeted owner/group/SACL data. If LDAP modify fails, do not expose a state where only the local object has been changed.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
`RIGHTS_GUID`	130	Structure and constant definitions
`ACE_FLAGS`	140	Structure and constant definitions
`OBJECT_ACE_FLAGS`	154	Structure and constant definitions
`ACCESS_MASK`	163	Structure and constant definitions
`SIMPLE_PERMISSIONS`	198	Structure and constant definitions
`ALLOWED_OBJECT_ACE_MASK_FLAGS`	211	Structure and constant definitions
`DACLedit`	220	`__init__()`, `read()`, `write()`, `remove()`, `backup()`, `restore()`, `search_target_principal_security_descriptor()`, `get_user_info()`, `resolveSID()`, `parseDACL()`, `parsePerms()`, `parseACE()`, and others
`parse_args()`	699	Module function
`main()`	741	Module function

Dependencies

Internal Impacket Modules

Module	Main Names Used
`impacket`	`version`
`impacket.examples`	`logger`, `utils`
`impacket.ldap`	`ldaptypes`
`impacket.msada_guids`	`EXTENDED_RIGHTS`, `SCHEMA_OBJECTS`
`impacket.uuid`	`bin_to_string`, `string_to_bin`
`impacket.examples.utils`	`init_ldap_session`, `parse_identity`

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
`ldap3`	`ldap3`	Imported directly; declared dependency
`ldapdomaindump`	`ldapdomaindump`	Imported directly; declared dependency

Output, Side Effects, and Required Privileges

Some operations change the target’s state. Confirm the target name, SID, and path before making changes.

Failure Paths and Cleanup

On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on ldap3, ldapdomaindump, ldaptypes, and msada_guids. DACLedit handles resolution, parsing, and changes. Preserve ACE order, object-specific GUIDs, inheritance flags, and the binary backup representation.

Verification

Syntax: python -m py_compile examples/dacledit.py
CLI: python examples/dacledit.py -h
Related test: tests/SMB_RPC/test_ldap.py