In this video, I'm going to demonstrate the SVU to self abuse trick.
Now, this trick is really useful when you have a TGT for a
machine account, and you want to access it, remotely.
So in the unconstrained delegation module,
we were able to use sharps ball trigger to obtain a TGT for
the domain controller.
So I have a copy of that ticket here.
So I'm just gonna do,
create net only to pass that ticket into a new log on
session,
and then simply impersonate the process.
So seven six five six.
And if we do a,
K list,
we can see that the, TGT is now here.
Now I want to quickly demonstrate
list the c dollar drive.
K. So we get access denied.
So we can use this little s v to self trick to obtain
a usable TGS or multiple TGSs for different services,
for the target machine.
And this is a variation
of the s for you command that we used previously.
So we need to give it,
many of the same options.
So we give it a user.
Well, this is DC two and
the ticket
is the, TGT again.
Now we want to, impersonate a user.
So impersonate
user, and we'll,
impersonate NLAM again.
The service, we can pass with the alt service parameter,
and we'll just do sifts again,
because it's easy to demonstrate.
And we also need to add this little,
self parameter, and that's pretty much it.
Because I've already created this sacrificial,
log on session, I can just do PTT to pass it in directly.
Okay.
And now if I run, Kaelus again,
you'll see that I now have
a TGS for SIFS, for four NLAM.
So if I try and list the c dollar share again, it will work.