Kerberos Unconstrained Delegation
Kerberos Unconstrained Delegation
General/Basic or Unconstrained Delegation which allows the first hop server (web server in our example) to request access to any service on any computer in the domain.
Required
Define Unconstrained Delegation Machines
we need to user who has Access to the machine
Essentially this looks like so: User
--- authenticates to ---> IIS server
---> authenticates on behalf of the user ---> DB server
Tools
define Unconstrained Machines
Hint: discover users that who you have WriteDACL permission on there or do Enumeration to get user
Rubeus
After obtaining the TGT tickets from the domain controller, we can now request service tickets for the allowed services, i.e., CIFS and TIME, or alternate services like LDAP or WMI.
Coercer
mimikatz
now enumerating the computers which have unconstrained delegation enabl
Example output: We find the computer
WIN-Q4788GPE9L7
with unconstrained delegation enabled.
Step 2: Find Local Admin Access
Output: Our user has local admin access to the computer with unconstrained delegation.
Step 3: Enable PowerShell Remoting
Step 4: Create and Use a PowerShell Session
Bypass AMSI:
Step 5: Dump Secrets and List Tickets
Step 6: Export Tickets
Example output: Administrator
.kirbi
file.
Step 7: Monitor Actions on the Machine
Output: Administrator account detected.
Step 8: Pass the Ticket to Memory and Impersonate the User
Result: We are now the administrator on the machine.
Deep Dive into Unconstrained Delegation
Process Overview
Vegeta wants to access the
server web01
to list folders.The
web01
process impersonates Vegeta and creates a new thread with Vegeta's credentials.The server accesses the intended folder with the impersonated thread.
Configuration
To list computers with unconstrained delegation:
Network Traffic (Wireshark Capture)
Client requests a TGT.
Domain controller responds with the TGT.
Client requests a service ticket (TGS) for the web application.
Domain controller responds with the TGS.
Client requests another TGT to delegate to the web service.
Domain controller responds with a copy of the user TGT.
The application request goes to the web server.
The web service requests a TGS for the SQL server using the client's TGT.
Domain controller responds with the TGS.
Access is granted and the database server is successfully accessed.
Application replies.
Abusing Unconstrained Delegation
Continue monitoring and exploitation using appropriate PowerShell commands and tools.
📚$_References
Last updated