Introduction
Put up-Home windows 2000, Microsoft launched an possibility the place customers might authenticate to 1 system by way of Kerberos and work with one other system. This was made attainable by way of the delegation possibility. Unconstrained delegation is achieved by way of TGT forwarding approach which is what we’ll discuss on this article.
Kerberos Delegation
Kerberos Delegation allows a service to impersonate a pc or person with the intention to interact with a second service utilizing the person’s privileges and permissions.
The traditional illustration of why delegating is important, as an illustration when a person authenticates to an online server utilizing Kerberos or different protocols, and the server needs to work together with a SQL backend or file server.
Sort of Kerberos Delegation:
- Unconstrained delegation
- Constrained delegation
- RBCD (Useful resource-Based mostly Constrained Delegation)
Service Principal Identify
A singular identify (identifier) of a service occasion. SPNs are utilized by Kerberos authentication to affiliate a service occasion with a service logon account. This enables a consumer software to request that the service authenticate an account even when the consumer doesn’t have an account identify.
Unconstrained Delegation
The characteristic debuted initially in Home windows Server 2000 however it’s nonetheless there for backwards compatibility. Mainly, if a person requests a service ticket for a service on a server set with unconstrained delegation, that server will extract the person’s TGT and cache it in its reminiscence for later use. This implies the server can faux to be that person to any useful resource on the area.
On a pc account, an admin can set the next property for unconstrained delegation.
- AD Customers and Computer systems -> Computer systems -> Belief this pc for delegation to any service.
Key options of the unconstrained delegation are:
- Often, the privilege is given to computer systems operating companies like IIS, and MSSQL as a result of these computer systems often require some back-end connectivity to different assets.
- When given Delegation rights, these computer systems ask for a person’s TGT and retailer them of their cached reminiscence.
- With this TGT, they’ll entry back-end assets on behalf of the authenticated person.
- Catch is that these programs may request entry to any useful resource on the area utilizing this TGT!
An attacker might Abuse Unconstrained Delegation by requesting TGS for any area companies (SPN) utilizing person delegated TGT.
TGT extraction by way of Unconstrained Delegation
It’s apparent that we have to run our assault on the machine that has delegation enabled. So we’re assuming the attacker has compromised one such machine. Assumption 1: Attacker compromised DC1$ system operating IIS on Kerberos authentication.
- Assumption 2: Attacker has entry to a domain-joined system (Right here, powershell window operating on that system)
Now, in real-life situation, you won’t have direct entry to the DC system for simplicity now we have put in IIS on DC and utilizing that solely so that you just get the gist.
Transferring on with our extraction, we have to be taught the programs which have unconstrained delegation enabled. This may be performed by utilizing PowerShell and AD module.
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties trustedfordelegation,serviceprincipalname,description
The identical can be achieved by utilizing the powerview script which is a part of the PowerSploit framework created for offensive safety utilizing PowerShell. You will discover it right here.
As soon as an AD system is compromised, you possibly can set up and use powerview.
Import-Module .powerview.ps1 Get-NetComputer -Unconstrained
Now, on the goal system we have to run Rubeus in monitor mode on the dc1 system. After that, each time a person connects/authenticates to dc1$ Rubeus will dump TGT of the person.
rubeus.exe monitor /monitorinterval:10 /targetuser:dc1$ /nowrap
Now, let’s watch for real customers to connect with dc1$ operating IIS service. For simplicity, let’s do this manually utilizing the IWR module.
Invoke-WebRequest http://dc1.offense.native -UseDefaultCredentials -UseBasicParsing
As you possibly can see, Rubeus has now captured a brand new ticket granting ticket (TGT) from the person IGNITEAdministrator.
Now, you should use this TGT to request entry to any useful resource by requesting a TGS to that useful resource. You should utilize Rubeus asktgs for that goal. Comply with the detailed Rubeus information right here for extra.
Conclusion
The article demonstrated a delegation approach referred to as Unconstrained Delegation as a result of because the identify suggests, there are not any restrictions upon how the system that has delegation rights use a person’s authentication data. The safety loopholes made Microsoft introduce Constrained Delegation. You’ll learn extra about that within the subsequent article. Hope you preferred the article. Thanks for studying.
References: https://www.harmj0y.internet/weblog/activedirectory/
Creator: Harshit Rajpal is an InfoSec researcher and left and proper mind thinker. Contact right here
