Constrained Delegation
Constrained delegation was later introduced with Windows Server 2003 as a safer means for services to perform Kerberos delegation. It aims to restrict the services to which the server can act on behalf of a user. It no longer allows the server to cache the TGTs of other users, but allows it to request a TGS for another user with its own TGT.
\
\
In this case, SQL-2 can act on behalf of any **** user to the cifs service on DC-2. CIFS is very powerful, as it allows you to list file shares, upload and download files, and even interact with the Service Control Manager.
To find computers configured for constrained delegation, search for those whose msds-allowedtodelegateto attribute is not empty.
Constrained delegation can be configured on user accounts as well as computer accounts. Make sure you search for both.
To perform the delegation, we need the TGT of the principal (computer or user) trusted for delegation. The most direct way is to extract it with Rubeus dump:
You can also request one with Rubeus asktgt if you have NTLM or AES hashes.
\
With the TGT, perform an S4U request to obtain a usable TGS for CIFS.
\
Where:
/impersonateuseris the user we want to impersonate - they should have local admin access on the target machine. nlamb is a domain admin which is required for accessing the domain controller./msdsspnis the service principal name that SQL-2 is allowed to delegate to./useris the principal allowed to perform the delegation./ticketis the TGT for/user.
\
This will perform an S4U2Self first and then an S4U2Proxy. It's this final S4U2Proxy ticket that we need.
Make sure to always use the FQDN. Otherwise, you will see 1326 errors. \
Last updated