In this video, I'm going to go over the resource based constraint
delegation exercise.
I've already run get domain object acl,
to show that this SID here,
which is the developers group in the dev domain,
has, write property access over d c two.
And we can use this to write into the allow to act
on behalf of other identity fields of this computer in order to,
access it remotely.
Now, the, PowerShell command that we need,
I've just copied and pasted from the course material.
And this SID here needs to be a SID of a computer that we control.
Because we've been able to elevate our privileges on
workstation two, we can use the SID of workstation two.
So let's copy this.
And, first, let's actually do, get domain computer
identity dc two.
And under properties, let's just print out the MSDS
allowed to act
on behalf of other identity.
And there's currently nothing in there because
there's no RBCD configured.
So let's paste in, one liner here,
and then let's put this through,
get domain computer again
and then pipe us into set domain object.
And the, the objects that we want to set is obviously this attribute,
and we want it to equal
the, raw descriptive bytes that we've created here.
Okay. So let's do that.
Without verbose mode, you don't really see anything.
But then if we do,
get domain computer again, you will see that this field,
this attribute now has something in it.
So the next stage is to,
now that we have this in place to actually
gain access to the machine, we need to use an elevated,
beacon to get its TGT.
So triage first.
And then dump,
this one.
No wrap.
And then with this t g t, oops.
We will use Rubyus with its s v u command.
So, the user is workstation two dollar,
and this is its TGT.
We want to
impersonate
nlam,
and we'll use the SIF service again,
m s d s s p n.
And, no wrap
again.
Okay. So this is the SIFS ticket.
Create net only and the ticket.
Can quickly show that we don't have access to the DC.
Steel token, six two four four.
And now we do.
And then to clear up, this after the attack,
we can just do
powershell get to my computer
And then we're gonna pipe this back into set domain object.
And we're going to have the clear parameter
to clear this attribute
And then if we try to read it back again,
it's now gone.