Resource-based Constrained Delegation: Computer Object Takeover

Practice flashcards covering the concepts, requirements, and tools for conducting Resource-based Constrained Delegation (RBCD) attacks in Active Directory.

Resource-based Constrained Delegation (RBCD)

A computer object takeover attack that utilizes Generic write, Generic All, or Write Property (ACE) to a computer object to perform a delegation attack.

ms-DS-MachineAccountQuota

The attribute that determines the number of machines a domain user can join to the domain; it is set to 10 by default for all domain users.

msDS-AllowedToActOnBehalfOfOtherIdentity

The specific attribute that must be modified on a target service or object to enable an attacker's controlled machine account to act on behalf of others.

Windows 2012

The minimum version required for a Domain Controller (DC) to be vulnerable to Resource-based Constrained Delegation (RBCD) abuse.

Powermad

An offensive PowerShell module used to create new machine accounts using the command New-MachineAccount.

RawSecurityDescriptor

A security object created to define access control, which is converted to bytes and applied to the msds-allowedtoactonbehalfofotheridentity attribute on the target machine.

Rubeus

A Kerberos ticket tool used to request service tickets, generate RC4 hashes, and perform S4U (Service for User) attacks to impersonate users.

S4U (Service for User)

The Kerberos extension used by tools like Rubeus to request a service ticket for a victim machine as any user, such as a Domain Admin.

SafetyKatz

A tool used to extract AES keys by executing Mimikatz-style commands like sekurlsa::ekeys.

SID S-1-5-18

The well-known Security Identifier (SID) for the SYSTEM user.

lsadump::dcsync

A Mimikatz command used to retrieve Domain Controller hashes once a TGS for the LDAP service has been obtained.

rbcd.py

An Impacket script used to configure Resource-based Constrained Delegation by modifying objects over LDAP.

Find-InterestingDomainAcl

A command used to identify specific Access Control Lists in the domain that might be vulnerable to abuse.

sekurlsa::pth

A Mimikatz command used to perform 'Pass-the-Hash' to run processes with Domain Controller privileges.

Generic All

An Access Control Entry (ACE) that, when held over a computer object, provides the necessary permissions to perform a resource-based constrained delegation attack.