Right.
In this video, I'm going to demonstrate how to exploit constraint delegation.
I've run this query with AD search
to find any computers
where they're allowed to delegate to attribute is not null.
And we have one result here.
So SQL two is allowed to delegate to the CIFS service on d c two.
So if we can
compromise SQL two,
we will be able to use this configuration to also
compromise the domain controller.
We know from our domain recon that we can get to SQL two using j
king.
So I've used that to obtain a system beacon on SQL
two now because the delegation is configured on SQL
two, we need credential material for SQL two.
Ultimately, we need a TGT, for SQL two.
So that is why why, in this case, we want to,
move laterally to this machine.
You can also have users that are configured for constraint
delegation as well.
And so you would need to do the same.
Somehow obtain either their password, NTLM
hash, AES keys, TGT to, pull this off.
But with this beacon on SQL two, let's do Ruby's,
triage.
And we want, this one.
So this is the TGT for SQL two.
So let's get that with dump.
The lewyd is zero by
three e seven, and the service
is the k r b t g t service.
And let's do no wrap.
Okay.
And let's,
highlight that and copy it.
Now to perform the,
the actual attack,
we can use Ruby's again with the s for you command.
So the first argument I'm gonna put in is the user,
and this is the user that is configured
to perform the delegation.
So that's
SQL two.
We also need to give it the ticket
as well as the service that it's allowed to delegate to.
So that is with the MSDSSPN parameter.
And the service is cifs
d c two dot dev dot cyberbotic
dot io.
And then finally, we want to impersonate a user,
and we can do that with the impersonate
user parameter.
And the user needs to be a local admin on the target,
ideally, for us to remotely access it.
So if if this was a server,
we would need to figure out a domain user who is a local admin on it.
Because this is a domain controller,
we can just use a domain admin, so n lamb,
and that's it.
I will also add a no wrap as
well.
And you can see that we get, two tickets.
So it performs an SVU to self first,
and then it uses this to
generate the SVU to proxy request.
And then, and this ticket is the one that we want.
So let's take this.
And to use the ticket, I'll use the create net only, trick.
Okay.
I can quickly show that I obviously don't have access to
the domain controller right
now.
K. Access denied.
Steal token, six eight three six.
And then try and list it again. And there we go.
We can also try and, jump there using PS exec.
And we have to make sure that we are referencing the machine
with the fully qualified domain name.
Here we go, and we have a beacon now running on the domain controller.