ADKERB-004: Delegación sin restricciones: equipos
- Plataforma
- Active Directory
- Categoría
- AD Kerberos Security
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las cuentas de equipo con delegación sin restricciones (TrustedForDelegation) almacenan en caché el TGT de cualquier usuario que se autentique en ellas. Si un atacante compromete una de esas máquinas, puede extraer los TGT en caché y suplantar a cualquier usuario, incluidos los Domain Admins. Combinado con los ataques de coacción SpoolSample o PrinterBug, un atacante puede forzar a un controlador de dominio a autenticarse y capturar su TGT, llevando al compromiso total del dominio.
Por qué importa
Unconstrained delegation is the single most dangerous Kerberos misconfiguration outside of compromising the KDC itself. When a user authenticates to a service running on a TrustedForDelegation host, the user TGT (encrypted with krbtgt, valid for 10 hours by default, renewable for 7 days) is forwarded inside the service ticket and cached in LSASS by the receiving service so it can perform delegated calls. Any code running as SYSTEM on that host (a vulnerable web app, a hijacked agent, a local admin, a backup operator) can dump those tickets and impersonate the original principal forest-wide. The blast radius is not theoretical: an attacker does not have to wait for a Domain Admin to log on. The SpoolSample / PrinterBug coercion (Lee Christensen, 2018) and the MS-EFSR PetitPotam coercion (Gilles Lionel, 2021) let any authenticated principal force a domain controller computer account to authenticate to an attacker-chosen host, including a host the attacker controls because it is configured with unconstrained delegation. Within seconds the attacker holds DC$ TGTs and can perform DCSync against the domain. Microsoft documents this as a critical configuration to remediate, and Protected Users / "Account is sensitive and cannot be delegated" are explicit mitigations precisely because the attack path is so reliable.
Ruta de ataque
Step 1: Discovery. The attacker, holding any low-privilege foothold, queries LDAP for (userAccountControl:1.2.840.113556.1.4.803:=524288) and excludes the Domain Controllers OU. PowerView Get-DomainComputer -Unconstrained, BloodHound (Unconstrained Delegation edge), or the ADKERB-004 output give the same list. Any reachable non-DC in the list is a target. Step 2: Foothold on the unconstrained host. The attacker compromises the unconstrained computer through any normal path: a stale local admin password (LAPS not deployed), a Kerberoastable service account that runs on the host, an exposed RDP, a vulnerable application, or an existing agent foothold. SYSTEM is sufficient; LocalAdmin works because privilege can be elevated to SYSTEM via PsExec, Scheduled Tasks, or Service creation. Step 3: Coercion. The attacker enables ticket monitoring on the compromised host with Rubeus monitor /interval:5 /nowrap or Mimikatz sekurlsa::tickets /export. From any authenticated context (the same low-priv foothold) the attacker triggers a coercion against the target DC. SpoolSample.exe DC01 UNCONSTRAINED-HOST forces DC01$ to authenticate via the MS-RPRN PrinterBug. If Print Spooler is disabled on DCs, the attacker falls back to PetitPotam.py UNCONSTRAINED-HOST DC01 over MS-EFSR, DFSCoerce.py over MS-DFSNM, or the MS-FSRVP "ShadowCoerce" primitive. All four force a Kerberos AP-REQ from the DC machine account to a CIFS or HTTP SPN on the unconstrained host. Step 4: TGT capture. Because the host is TrustedForDelegation, the DC includes a forwarded TGT in the service ticket. Rubeus captures it (base64-encoded krbtgt-issued ticket for DC01$). On disk it is a .kirbi file; in memory it is visible to sekurlsa::tickets. Step 5: DCSync. The attacker injects the captured DC01$ TGT with Rubeus ptt /ticket:<base64> and runs mimikatz lsadump::dcsync /domain:contoso.local /user:krbtgt or secretsdump.py -k DC01.contoso.local. The DC machine account holds the Replicating Directory Changes and Replicating Directory Changes All extended rights by virtue of being a domain controller, so the request succeeds. The attacker now holds the krbtgt hash and can forge Golden Tickets for any principal in the domain. Total elapsed time from foothold on the unconstrained host to krbtgt: typically under five minutes.
Cómo lo evalúa Guerrilla
Guerrilla performs a single LDAP search per domain in the forest using the bitwise-AND OID matching rule 1.2.840.113556.1.4.803 against userAccountControl with the value 524288 (TRUSTED_FOR_DELEGATION). For each returned computer object it pulls userAccountControl, primaryGroupID, sAMAccountName, dNSHostName, operatingSystem, operatingSystemVersion, lastLogonTimestamp, servicePrincipalName, msDS-AllowedToActOnBehalfOfOtherIdentity, and whenChanged. Computer accounts whose primaryGroupID equals 516 (Domain Controllers) or 521 (Read-Only Domain Controllers) are filtered out and recorded as expected. Every remaining account is rendered as a Critical finding because the configuration is exploitable by design. The check enriches each finding with: whether the host responds on TCP 445 (likely target of CIFS coercion), whether the Print Spooler service answers on the MS-RPRN named pipe (PrinterBug exposure), the SPN list (useful for understanding which services would receive forwarded TGTs), and a stale-account flag if lastLogonTimestamp is more than 90 days old (a dormant unconstrained host is still exploitable if it can be powered on). The check does not require Domain Admin; a normal authenticated user can read userAccountControl on computer objects.
Valor recomendado
Ninguna cuenta de equipo con delegación sin restricciones salvo los controladores de dominio (que la requieren de forma inherente). Todo el resto de la delegación migrado a delegación restringida o restringida basada en recursos.
Remediación
Identifica los equipos con delegación sin restricciones usando Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation. Excluye los controladores de dominio de los hallazgos. Para el resto, migra a delegación restringida identificando los servicios concretos a los que necesitan delegar y configura msDS-AllowedToDelegateTo. Añade las cuentas sensibles al grupo Protected Users para impedir que sus TGT se almacenen en caché. Marca las cuentas de alto valor como 'La cuenta es confidencial y no se puede delegar'.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6
- ANSSI
- R35
- CIS AD Benchmark
- 7.3.1
- MITRE ATT&CK
- T1558.001