In this video, I'm going to demonstrate how to leverage unconstrained delegation.
So this LDAC query will just return
the SAM account name and the DNS host name of computers that
have unconstrained delegation configured.
Now DCs, they always have it.
So we can,
already, then it's kinda game over anyway.
But this machine, web dollar, is the web server.
And we know from domain recon that we can get to
this machine using j king.
So I've done that to obtain a system beacon.
Now the nicest way to get all the tickets out from
this machine is to use
and so let's go ahead and do that.
I'll give it quite a short interval of ten seconds and add
no wrap as well.
Okay. So it looks like we got lucky.
So one of the tickets that it's found already was for n lamb,
who is, of course, a domain admin.
So we can,
just copy this base sixty four encoded ticket.
We also have,
the machine account of the web server itself as well as j king.
The reason we have j king is because it got cached when I
used the account to move Locksmith to it using PS exec.
Now, for sanity's sake, let's just
show that we don't have access to the domain controller.
So that would be dev dc2. Dev. Cyberbotik.
Io.
Okay. Obviously, access denied.
So let's use, Ruby as create net only.
And I just tend to give it
the command prompt.
And the only other thing we need to give it is the ticket itself.
And hit go.
And then this will create, an instance of command prompt
with a new log on session,
and it will automatically import the TGT,
into that session.
So all we have to do is steal token
three five five six.
And if we try and list the c dash of the domain
controller again,
it will work.
Now we can also use those methods of coercing other
machines to try and authenticate to this web server.
So let's show the spool sample.
So, back on my original beacon here,
I'm going to run execute assembly,
sharp system triggers.
And we'll use the,
the spool sample trigger.
And this takes two arguments.
The first is the, target machine.
So we will coerce the domain controller to
trigger an authentication attempt.
And we want it to try and authenticate to the web server.
Okay. And that's all we need there.
And then shortly after that runs,
we should hopefully see this beacon, here we go, light up.
And if we go to it, we get the TGT for b pharma.
We don't really care about that.
But we also have the TGT for the domain controller itself as well.
The way you would utilize these is a little bit different.
So we could use the s for you to self trick, and we'll
see that in a upcoming video.