RBCD – Resource-Based Constrained Delegation Abuse
Resource-Based Constrained Delegation inverts the delegation model, instead of configuring which accounts can delegate to a resource, the resource itself specifies which accounts can delegate to it via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. If you have write access to that attribute on a target computer object, you can grant your own controlled account delegation rights to the target and then impersonate any user, including domain admins, against its services.
RBCD requires two things: an account you control with an SPN (a computer account works, and you can create one if ms-DS-MachineAccountQuota is greater than 0), and write access to the target computer object's msDS-AllowedToActOnBehalfOfOtherIdentity attribute. Write access is commonly found via GenericAll, GenericWrite, or WriteDACL ACEs on computer objects, which BloodHound maps clearly.
For using the resulting ticket for lateral movement, see https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket.
Step 1: Create a Controlled Machine Account
If you do not already control an account with an SPN, create a computer account. By default, domain users can create up to 10 machine accounts (ms-DS-MachineAccountQuota):
Note the computer name and password, you need the hash in step 3.
If MachineAccountQuota is 0, you need to use an existing computer account you already control (one where you have local admin and can extract the machine hash).
Step 2: Write the Delegation Attribute
Set msDS-AllowedToActOnBehalfOfOtherIdentity on the target computer to allow your controlled machine account to delegate to it. Use impacket-rbcd or PowerView from a Windows host.
From Linux with Impacket:
Verify the write succeeded:
Step 3: Get the Hash of Your Controlled Machine Account
You need the NT hash of ATTACKPC$ to request the S4U tickets. Get it with Impacket using the password you set:
Or calculate it directly from the password:
Step 4: Request a Service Ticket via S4U
Use impacket-getST to run S4U2Self and S4U2Proxy, impersonating a domain admin against the target:
With the NT hash directly:
This saves Administrator.ccache.
Step 5: Use the Ticket
Targeting a Domain Controller
If your write target is a DC and you can impersonate a domain admin against its LDAP service, you can perform DCSync directly:
This dumps all domain hashes without needing to land a shell on the DC.
From Windows with Rubeus
Request the S4U ticket chain and inject it:
Cleanup
Remove the delegation attribute after the engagement:
Delete the machine account you created:
References
-
Fortra addcomputer.py, rbcd.py, and getST.py documentation.
-
GhostPack s4u module documentation.
-
Elad Shamir Original RBCD abuse research covering attack prerequisites and mechanics.
Was this helpful?
Your feedback helps improve this page.