Unconstrained delegation Enum
Unconstrained delegation is a configuration that attackers can potentially use to impersonate a user or service account and gain access to sensitive resources in an organization's network. To mitigate the risks associated with unconstrained delegation, organizations should take steps to fully understand such configurations, implement best practices regarding privilege, apply effective remediation steps, and replace unconstrained delegation with resource-based delegation wherever possible.
One way to find unconstrained delegation is to look in bloodhound
MATCH (c {unconstraineddelegation:true}) return cIf you want to search for unconstrained delegation system (out of domain controller) :
With a socks connection you can only use smbexec or atexec. Neither wmiexec, psexec nor dcomexec will work. (explainations here : https://github.com/SecureAuthCorp/impacket/issues/412 )
Run ntlmrelayx.py and wait for a connecting for fernando.alonzo
Run Responder
Run smbeexe to get interactive shell
Prepare our server containing Rubeus.exe and our AMSI bypass.
On the shell session bypass AMSI :
#check status of Defender
And now force a coerce of the DC NYC to the DC Bronx.
We look on the triage again :
And now the tgt of NYC is present
To extract it (relaunch coercer and 1 sec later launch the following dump command): (i don’t know why but the rubeus monitor mode doesn’t want to run in execute assembly)
We now have the TGT of the domain controller
Let’s continue on linux to pass the ticket and launch dcsync with secretdump :
copy the ticket without space and return line (in vim i do : :%s/\s*\n\s*//g) convert the ticket to ccache use the kerberos ticket and launch secretdump
Last updated