search
GitHubPsMapExec

Constrained Delegation

hashtag
Requirements

Compromise of the Active Directory Object that is configured for "Trusted to Auth".

hashtag
Explanation

Recommended to read first: Unconstrained Delegationarrow-up-right

Microsoft introduced Constrained Delegation in Windows Server 2003 to provide a more secure form of delegation compared to the high-risk Unconstrained Delegation.

With Constrained Delegation, administrators can specify the services or applications for which a server is allowed to act on behalf of a user, thereby limiting the attack surface. This feature can reduce the risk of an attacker impersonating a user and accessing resources that they are not authorized to access.

hashtag
Enumeration

PowerView

# Get computer Constrained Delegation
Get-DomainComputer -TrustedToAuth| Select DnsHostName,UserAccountControl,msds-allowedtodelegateto | FL

# Get user Constrained Delegation
Get-DomainUser -TrustedToAuth

PowerShell

# Search both users and computers for Constrained Delegation
Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo

hashtag
Obtain TGT

Triage current tickets

Method: Dump system TGT

hashtag
Obtains TGS for service

Example

Output

hashtag
Pass the Ticket (PtT)

With effective Domain Administrator rights on the primary Domain Controllers for the CIFS service we can perform actions based on CIFS such as Psexec and remotely listing the C$ drive.

hashtag
Alternate Service Name

Kerberos uses a Service Principal Name (SPN) to identify a service during authentication, which is typically a combination of the service name and the host's name where the service is running. Rubeus.exe includes an option called /altservicename that enables an attacker to use a different service name when constructing the SPN. This option can be helpful in certain situations, such as when the default service name is unavailable or the attacker wants to target a specific service.

In this instance, we're leveraging the TGT issued for SRV01$ to obtain a TGS for LDAP.

Following on from the section: Obtain TGT use the following commands to generate a TGS for the alternative service name.

Example

Output

From the output below we see that firstly,

In the above output we alternate the CIFS service for LDAP. As the Domain Administrator has been impersonated this can be used to perfrom DCSync.

hashtag
Generate service tickets for all service types

Last updated