Last updated
Last updated
Constrained delegation was later introduced with Windows Server 2003 as a safer means for services to perform Kerberos delegation. It aims to restrict the services to which the server can act on behalf of a user. It no longer allows the server to cache the TGTs of other users, but allows it to request a TGS for another user with its own TGT.
In this case, SQL-2 can act on behalf of any user to the cifs service on DC-2. CIFS is quite powerful as it allows you to list file shares and transfer files. To find computers configured for constrained delegation, search for those whose msds-allowedtodelegateto attribute is not empty.
Constrained delegation can be configured on user accounts as well as computer accounts. Make sure you search for both.
To perform the delegation, we need the TGT of the principal (computer or user) trusted for delegation. The most direct way is to extract it with Rubeus dump:
You can also request one with Rubeus asktgt if you have NTLM or AES hashes.
With the TGT, perform an S4U request to obtain a usable TGS for CIFS on DC-2. Remember that we can impersonate any user in the domain, but we want someone who we know to be a local admin on the target. In this case, a domain admin makes the most sense.
This will perform an S4U2Self first and then an S4U2Proxy.
where:
Make sure to always use the FQDN. Otherwise, you will see 1326 errors.