Skip to content

Commit fc43d62

Browse files
FuzzySecurityFuzzySecurity
authored
Merge pull request #1 from G0ldenGunSec/main
Delegation Identification Update - Constrained + RBCD
2 parents 997a45c + bb43a0a commit fc43d62

File tree

2 files changed

+133
-20
lines changed

2 files changed

+133
-20
lines changed

‎README.md‎

Lines changed: 29 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -615,15 +615,15 @@ C:\> StandIn.exe --spn
615615
Supported ETypes : RC4_HMAC_DEFAULT
616616
```
617617

618-
## Unconstrained / constrained delegation
618+
## Unconstrained / constrained / resource-based constrained delegation
619619

620620
#### Use Case
621621

622-
> *This function enumerates all accounts that are permitted to perform [unconstrained](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation) or [constrained](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation) delegation. These assets can be used to expand access or achieve objectives.*
622+
> *This function enumerates all accounts that are permitted to perform [unconstrained](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation), [constrained](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation), or [resource-based constrained](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution) delegation. These assets can be used to expand access or achieve objectives.*
623623
624624
#### Syntax
625625

626-
Return all accounts that have either unconstrained or consrtained delegation permissions.
626+
Return all accounts that have either unconstrained or constrained delegation permissions, or have inbound resource-based constrained delegation privileges.
627627

628628
```
629629
C:\> StandIn.exe --delegation
@@ -632,8 +632,8 @@ C:\> StandIn.exe --delegation
632632
633633
[?] Found 3 object(s) with unconstrained delegation..
634634
635-
[*] SamAccountName : M-2019-05$
636-
DistinguishedName : CN=M-2019-05,OU=Servers,OU=OCCULT,DC=main,DC=redhook,DC=local
635+
[*] SamAccountName : M-2019-03$
636+
DistinguishedName : CN=M-2019-03,OU=Servers,OU=OCCULT,DC=main,DC=redhook,DC=local
637637
userAccountControl : WORKSTATION_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
638638
639639
[*] SamAccountName : M-W16-DC01$
@@ -644,18 +644,31 @@ C:\> StandIn.exe --delegation
644644
DistinguishedName : CN=M-W19-DC01,OU=Domain Controllers,DC=main,DC=redhook,DC=local
645645
userAccountControl : SERVER_TRUST_ACCOUNT, TRUSTED_FOR_DELEGATION
646646
647-
[?] Found 1 object(s) with constrained delegation..
648-
649-
[*] SamAccountName : M-2019-06$
650-
DistinguishedName : CN=M-2019-06,OU=Servers,OU=OCCULT,DC=main,DC=redhook,DC=local
651-
msDS-AllowedToDelegateTo : ldap/m-w16-dc01.main.redhook.local/main.redhook.local
652-
ldap/m-w16-dc01.main.redhook.local
653-
ldap/M-W16-DC01
654-
ldap/m-w16-dc01.main.redhook.local/MAIN
655-
ldap/M-W16-DC01/MAIN
656-
ldap/m-w16-dc01.main.redhook.local/DomainDnsZones.main.redhook.local
657-
ldap/m-w16-dc01.main.redhook.local/ForestDnsZones.main.redhook.local
647+
[?] Found 2 object(s) with constrained delegation..
648+
649+
[*] SamAccountName : M-2019-04$
650+
DistinguishedName : CN=M-2019-04,OU=Servers,OU=OCCULT,DC=main,DC=redhook,DC=local
651+
msDS-AllowedToDelegateTo : HOST/m-w16-dc01.main.redhook.local/main.redhook.local
652+
HOST/m-w16-dc01.main.redhook.local
653+
HOST/M-W16-DC01
654+
HOST/m-w16-dc01.main.redhook.local/MAIN
655+
HOST/M-W16-DC01/MAIN
656+
Protocol Transition : False
657+
userAccountControl : WORKSTATION_TRUST_ACCOUNT
658+
659+
[*] SamAccountName : M-2019-05$
660+
DistinguishedName : CN=M-2019-05,OU=Servers,OU=OCCULT,DC=main,DC=redhook,DC=local
661+
msDS-AllowedToDelegateTo : cifs/m-2012r2-03.main.redhook.local
662+
cifs/M-2012R2-03
663+
Protocol Transition : True
658664
userAccountControl : WORKSTATION_TRUST_ACCOUNT, TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
665+
666+
[?] Found 1 object(s) with resource-based constrained delegation..
667+
668+
[*] SamAccountName : M-10-1909-01$
669+
DistinguishedName : CN=M-10-1909-01,OU=Workstations,OU=OCCULT,DC=main,DC=redhook,DC=local
670+
Inbound Delegation : Server Admins [GROUP]
671+
userAccountControl : WORKSTATION_TRUST_ACCOUNT
659672
```
660673

661674
## DC's

‎StandIn/StandIn/Program.cs‎

Lines changed: 104 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
using System;
1+
using System;
22
using CommandLine;
33
using System.DirectoryServices;
44
using System.DirectoryServices.ActiveDirectory;
@@ -1100,7 +1100,7 @@ public static void getDelegationAccounts(String sDomain = "", String sUser = "",
11001100
}
11011101

11021102
// Constrained delegation filter
1103-
ds.Filter = "(&(userAccountControl:1.2.840.113556.1.4.803:=16777216)(msDS-AllowedToDelegateTo=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))";
1103+
ds.Filter = "(&(msDS-AllowedToDelegateTo=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))";
11041104

11051105
// Enum
11061106
try
@@ -1125,12 +1125,112 @@ public static void getDelegationAccounts(String sDomain = "", String sUser = "",
11251125
if (iDelegateCount == 0)
11261126
{
11271127
Console.WriteLine(" msDS-AllowedToDelegateTo : " + oColl);
1128-
} else
1128+
}
1129+
else
11291130
{
11301131
Console.WriteLine(" " + oColl);
11311132
}
11321133
iDelegateCount += 1;
11331134
}
1135+
if (((Int32)mde.Properties["userAccountControl"].Value & (Int32)hStandIn.USER_ACCOUNT_CONTROL.TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION) != 0)
1136+
{
1137+
Console.WriteLine(" Protocol Transition : True");
1138+
}
1139+
else
1140+
{
1141+
Console.WriteLine(" Protocol Transition : False");
1142+
}
1143+
Console.WriteLine(" userAccountControl : " + (hStandIn.USER_ACCOUNT_CONTROL)omProps["useraccountcontrol"][0]);
1144+
}
1145+
catch (Exception ex)
1146+
{
1147+
Console.WriteLine("[!] Failed to enumerate DirectoryEntry properties..");
1148+
if (ex.InnerException != null)
1149+
{
1150+
Console.WriteLine(" |_ " + ex.InnerException.Message);
1151+
}
1152+
else
1153+
{
1154+
Console.WriteLine(" |_ " + ex.Message);
1155+
}
1156+
}
1157+
}
1158+
}
1159+
catch (Exception ex)
1160+
{
1161+
Console.WriteLine("[!] Failed to enumerate accounts..");
1162+
if (ex.InnerException != null)
1163+
{
1164+
Console.WriteLine(" |_ " + ex.InnerException.Message);
1165+
}
1166+
else
1167+
{
1168+
Console.WriteLine(" |_ " + ex.Message);
1169+
}
1170+
}
1171+
1172+
// Resource-Based Constrained delegation filter
1173+
ds.Filter = "(&(msDS-AllowedToActOnBehalfOfOtherIdentity=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))";
1174+
1175+
// Enum
1176+
try
1177+
{
1178+
// Search
1179+
SearchResultCollection oObject = ds.FindAll();
1180+
Console.WriteLine("\n[?] Found " + oObject.Count + " object(s) with resource-based constrained delegation..");
1181+
1182+
// For each account that has rbcd configured on it pointing to other objects
1183+
foreach (SearchResult sr in oObject)
1184+
{
1185+
try
1186+
{
1187+
DirectoryEntry mde = sr.GetDirectoryEntry();
1188+
ResultPropertyCollection omProps = sr.Properties;
1189+
1190+
Console.WriteLine("\n[*] SamAccountName : " + omProps["samAccountName"][0].ToString());
1191+
Console.WriteLine(" DistinguishedName : " + omProps["distinguishedName"][0].ToString());
1192+
1193+
1194+
String sFilter = "(&(|";
1195+
RawSecurityDescriptor rsd = new RawSecurityDescriptor((byte[])omProps["msDS-AllowedToActOnBehalfOfOtherIdentity"][0], 0);
1196+
// Get the ACE for each entry in the object's DACL, each of which points to an object that has inbound RBCD privileges.
1197+
foreach (CommonAce ace in rsd.DiscretionaryAcl)
1198+
{
1199+
sFilter = sFilter + "(objectSid=" + ace.SecurityIdentifier.ToString() + ")";
1200+
}
1201+
sFilter = sFilter + ")(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))";
1202+
1203+
ds.Filter = sFilter;
1204+
SearchResultCollection delegationObjs = ds.FindAll();
1205+
1206+
UInt32 iDelegateCount = 0;
1207+
// Parse the results of the search query to get for each object that has inbound RBCD privileges on the current object.
1208+
foreach (SearchResult delegationObj in delegationObjs)
1209+
{
1210+
ResultPropertyCollection srProps = delegationObj.Properties;
1211+
if (iDelegateCount == 0)
1212+
{
1213+
if (srProps.Contains("grouptype"))
1214+
{
1215+
Console.WriteLine(" Inbound Delegation : " + srProps["samAccountName"][0].ToString() + " [GROUP]");
1216+
} else
1217+
{
1218+
Console.WriteLine(" Inbound Delegation : " + srProps["samAccountName"][0].ToString());
1219+
}
1220+
}
1221+
else
1222+
{
1223+
if (srProps.Contains("grouptype"))
1224+
{
1225+
Console.WriteLine(" " + srProps["samAccountName"][0].ToString() + " [GROUP]");
1226+
}
1227+
else
1228+
{
1229+
Console.WriteLine(" " + srProps["samAccountName"][0].ToString());
1230+
}
1231+
}
1232+
iDelegateCount += 1;
1233+
}
11341234
Console.WriteLine(" userAccountControl : " + (hStandIn.USER_ACCOUNT_CONTROL)omProps["useraccountcontrol"][0]);
11351235
}
11361236
catch (Exception ex)
@@ -1172,7 +1272,7 @@ public static void getASREPAccounts(String sDomain = "", String sUser = "", Stri
11721272
}
11731273
DirectorySearcher ds = so.searcher;
11741274

1175-
// Unconstrained delegation filter
1275+
// ASREP filter
11761276
ds.Filter = "(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))";
11771277

11781278
// Enum

0 commit comments

Comments
 (0)