Unconstrained Delegation

Attack Requirements

• Valid credentials for a domain user account. Most of the time the account is compromised in the initial foothold stage.
• A domain computer that has the delegation option “Trust This computer for delegation to any service” enabled.
• To dump the TGTs, we need to have a local admin privileges on the compromised delegated computer.

Attack Vectors

• Vertical Privilege Escalation vector to a higher privileges user like Domain Admin
• Horizontal privilege escalation to access different resources within the network not accessible to the original compromised account

Attack Steps

Identify accounts with delegation property is set to True

PowerView

Get-NetComputer -Unconstrained

AD Module

Get-ADComputer -Filter {TrustedForDelegation -eq $True}

Get-ADUser -Filter {TrustedForDelegation -eq $True}