Without protocol transition
Last updated
Last updated
To look at this option, rdp with Fernando.Alonzo
This result to this in the windows GUI :
A good example of exploitation can be found here: https://snovvcrash.rocks/2022/03/06/abusing-kcd-without-protocol-transition.html
The self-RBCD trick doesn’t work anymore. When i was writing this article i tried the self-rbcd without success many times. After multiple tries and fail i ask to charlie (@_nwodtuhs) what i am doing wrong, because i can’t find out why this don’t work as expected. He explained to me that the self rbcd trick didn’t work anymore and have been silent patch by Microsoft :’(
To exploit the constrained delegation here we only need a forwardable TGS as administrator to any service on castelblack
But if we do a s4u (s4u2self + s4u2proxy) like we did with protocol transition, the s4uself will send us a not forwardable TGS and the attack will fail.
So to exploit and get the forwardable TGS we need, we first need to add a computer and use RBCD between the created computer (rbcd_const$) and the computer who have delegation set (here castelblack$).
By doing that, you can do a s4u2self followed by a s4u2proxy on the added computer and the result is a forwardable tgs on hots/castelblack$ as administrator.
Once that done, you have the forwardable ticket to pass to s4u2proxy, and we even can change the request service with -altservice
Do the s4u2self followed by the s4u2proxy on Yonkers (this is the classic RBCD attack)
And launch the s4uProxy with the forwardable ticket
After the exploit a little clean up of the lab, flush the rbcd entry and delete the computer account with a domain admin:
