Krbrelayx

krbrelayx.py by dirkjanm abuses Kerberos unconstrained delegation. When you control an account or computer configured with unconstrained delegation, any principal that authenticates to it via Kerberos forwards a usable TGT inside the ticket. Running krbrelayx.py with the account's key (AES key or NT hash) and no relay target puts it in export mode: it starts an SMB/HTTP listener, decrypts incoming Kerberos service tickets, and writes the embedded TGTs to ccache files on disk. Coercing a Domain Controller (via PetitPotam or the printer bug) to authenticate yields the DC's TGT, which can then be used with secretsdump.py for a full DCSync. This is the Kerberos analogue to NTLM relaying and bypasses SMB signing. Command Reference: Delegation account AES256 key: 5db474e563f34e4bb62e04eecd4a6f92 Domain Controller IP: 10.10.10.1 Output ccache: out.ccache

# Export mode: capture forwarded TGTs using the unconstrained account's key
python3 krbrelayx.py -aesKey 5db474e563f34e4bb62e04eecd4a6f92
# Then coerce dc.test.local to authenticate (PetitPotam/printerbug) to drop a TGT ccache

Native

Credential Access, PrivEsc, Exploitation

Requires

AES_Key

Services

Kerberos

Refs

github.com/dirkjanm/krbrelayx

dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/

www.thehacker.recipes/ad/movement/kerberos/delegations/unconstrained