1 - Enumerate users in the domain for whom Constrained Delegation is enabled
For such a user, request a TGT from the DC and obtain a TGS for the service to which delegation is configured.
Pass the ticket and access the service.
2 - Enumerate computer accounts in the domain for which Constrained Delegation is enabled
For such a user, request a TGT from the DC.
Obtain an alternate TGS for LDAP service on the target machine.
Use the TGS for executing DCSync attack.
Flag 26 [dcorp-adminsrv] - Value of msds-allowedtodelegate to attribute of dcorp-adminsrv 🚩
Flag 27 [dcorp-adminsrv] - Alternate service accessed on dcorp-dc by abusing Constrained delegation on dcorp-adminsrv 🚩
Solutions
1 - Enumerate users in the domain for whom Constrained Delegation is enabled
To enumerate users with constrained delegation we can use PowerView. Run the below command from a PowerShell session started using Invisi-Shell:
We already have secrets of websvc from dcorp-admisrv machine. We can either use Kekeo or Rubeus to abuse that.
In the below command (into an administrative cmd), we request get a TGS for websvc as the Domain Administrator - Administrator. Then the TGS used to access the service specified in the /msdsspn parameter (which is filesystem on dcorp-mssql):
and check if the TGS is injected using: klist
Try accessing filesystem on dcorp-mssql:
2 - Enumerate computer accounts in the domain for which Constrained Delegation is enabled
Continue, to enumerate the computer accounts with constrained delegation enabled using PowerView: Get-DomainComputer -TrustedToAuth
We have the AES keys of dcorp-adminsrv$ from dcorp-adminsrv machine. Run the below command from an elevated command prompt as SafetyKatz, that we will use for DCSync, would need that:
Flag 26 [dcorp-adminsrv] - Value of msds-allowedtodelegate to attribute of dcorp-adminsrv 🚩
The flag it the value of msds-allowedtodelegate to attribute of dcorp-adminsrv: {TIME/dcorp-dc.dollarcorp.XXXXXXXXXXXXXXXXXXXXXXXXXX}
Flag 27 [dcorp-adminsrv] - Alternate service accessed on dcorp-dc by abusing Constrained delegation on dcorp-adminsrv 🚩
We can discover the alternate service using the following command:
