Obj 15 Unconstrained Delegation

Task - Find a server in the dcorp domain where Unconstrained Delegation is enabled. Compromise the server and escalate to Domain Admin privileges. Escalate to Enterprise Admins privileges.

We first need to find a server that has unconstrained delegation enabled

Find server with Unconstrained Delegation Enabled

PS C:\AD\Tools> Get-DomainComputer -Unconstrained | select -ExpandProperty name

Since the prerequisite for elevation using Unconstrained delegation is having admin access to the machine, we need to compromise a user which has local admin access on appsrv. Recall that we extracted secrets of appadmin, srvadmin and websvc from dcorp-adminsrv. Let’s check if anyone of them have local admin privileges on dcorp-appsrv.

Try one of the servers to see if we have local admin privileges

C:\WINDOWS\system32> C:\AD\Tools\SafetyKatz.exe "sekurlsa::pth /user:appadmin 
/domain:dollarcorp.moneycorp.local 
/aes256:68f08715061e4d0790e71b1245bf20b023d08822d2df85bff50a0e8136ffe4cb
/run:cmd.exe" "exit"

In the new process run the following commands to see if we have local admin access

C:\Windows\system32> C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat
PS C:\Windows\system32> . C:\AD\Tools\Find-PSRemotingLocalAdminAccess.ps1
PS C:\Windows\system32> Find-PSRemotingLocalAdminAccess

We have local admin access on appsrv so we can copy Rubeus over 

C:\Windows\system32>echo F | xcopy C:\AD\Tools\Rubeus.exe \\dcorpappsrv\C$\Users\Public\Rubeus.exe /Y

We are going to run Rubeus in listener mode on appsrv

From student/host vm let's use MS-RPRN to force Authentication from dcorp-dc

We should start seeing some out put on our Rubeus listener now

Copy the base64 encoded ticket and use it with Rubeus on student VM. Run the below command from an elevated shell as the SafetyKatz command that we will use for DCSync needs to be run from an elevated process

Now we can run a DCSync attack from the new process

- Part 2 Elevate to Enterprise Admins -

To get Enterprise Admin privileges, we need to force authentication from mcorp-dc. Run the below command to listen for mcorp-dc$ tickets on dcorp-appsrv

Let's start a session on appsrv and setup a Rubeus listener

Lets' run MS-RPRN on our host vm to trigger a response from mcorp-dc to dcorp-appsrv

We should get a response on our Rubeus listener

As previously, copy the base64 encoded ticket and use it with Rubeus on student VM. Run the below command from an elevated shell as the SafetyKatz command that we will use for DCSync needs to be run from an elevated process:

Run Rubeus to create a new process

Now we can run the DCSync attack from the new process

We are now Enterprise Admins!

- Part 3 Check the server if there is an existing DA ticket

Let's start a new invishell on our host vm

Now let's get Mimikatz on the session and then go back into the session

Create a userX directory where X is your userId to avoid overwriting tickets of other users

Now let's invoke Mimikatz to dump the tickets

Now we can grep through the tickets to see which one we want to use.

Once we find a ticket to reuse we can inject it into lsass to get DA privs

Now we can check to see if it worked

PreviousObj 14 Kerberoast Pass CrackNextCRTP Diagrams

Last updated