ADKERB-007: Delegación restringida basada en recursos
- Plataforma
- Active Directory
- Categoría
- AD Kerberos Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La delegación restringida basada en recursos (RBCD) permite al recurso de destino controlar qué cuentas pueden delegar en él mediante el atributo msDS-AllowedToActOnBehalfOfOtherIdentity. Aunque es más segura por diseño que la delegación restringida tradicional, la RBCD puede abusarse si un atacante obtiene acceso de escritura a un objeto de equipo para configurar rutas de delegación no autorizadas. Es una técnica habitual de post-explotación.
Por qué importa
RBCD is the most reliable AD privilege-escalation primitive currently in active use by red teams and intrusion sets. Unlike traditional unconstrained or constrained delegation, configuring RBCD does not require Domain Admin or SeEnableDelegationPrivilege: it only requires write access to the target computer object. The default value of ms-DS-MachineAccountQuota is 10, which means any authenticated user can create a computer account (with a known password) and use it as the "controlled" service principal needed for the S4U2Self / S4U2Proxy chain. Combined with a single object-takeover primitive (often surfaced by BloodHound as GenericWrite or WriteOwner from a stale group, an over-privileged service account, or a relay-coerced machine account), an attacker can pivot to SYSTEM on the target host without touching LSASS, dumping the DC, or triggering protected-process restrictions. RBCD is also a popular persistence mechanism: an attacker who has briefly held Domain Admin can plant msDS-AllowedToActOnBehalfOfOtherIdentity entries on Tier 0 hosts (DCs, ADFS, ADCS, Exchange) granting a low-noise foothold account the ability to impersonate any user against those resources at will, surviving credential rotations and DA cleanup. Microsoft does not log writes to this attribute by default; without targeted SACLs, the modification is invisible in the Security event log.
Ruta de ataque
Step 1: Discovery. The attacker, holding any low-privilege foothold, runs BloodHound and queries for AddAllowedToAct edges or runs Guerrilla ADKERB-007 / Get-DomainComputer -ResolveSIDs -Properties msds-allowedtoactonbehalfofotheridentity to identify computers where the current principal (or any group they are in) has GenericWrite, GenericAll, WriteDacl, or WriteOwner. Common sources of this primitive: NTLM relay against LDAP/LDAPS without channel binding (the relayed machine account ends up with WriteDacl over itself via the "Pre-Windows 2000 Compatible Access" or default Domain Computers ACL), stale help-desk groups, Exchange shared permissions, SCCM client push installation accounts, and any service that resets computer passwords. Step 2: Controlled SPN creation. The attacker creates a new computer account using their existing user credentials, exploiting the default ms-DS-MachineAccountQuota of 10. Powermad New-MachineAccount -MachineAccount "evil$" -Password (ConvertTo-SecureString "Summer2026!" -AsPlainText -Force) or impacket addcomputer.py. The new account automatically gets a HOST/evil SPN, which is required for S4U2Self to issue a forwardable ticket. Step 3: Write the attribute. The attacker writes a security descriptor onto msDS-AllowedToActOnBehalfOfOtherIdentity of the target computer granting the new evil$ account the right to act on behalf of any user. PowerView Set-DomainRBCDelegation -Identity TARGET -DelegateFrom evil$ or impacket rbcd.py -delegate-from "evil$" -delegate-to "TARGET$" -action write. Step 4: S4U2Self. The attacker uses the evil$ credentials to request a service ticket to evil$ on behalf of a privileged user (typically Administrator) using S4U2Self. Rubeus s4u /user:evil$ /rc4:<NT hash> /impersonateuser:Administrator /msdsspn:HOST/TARGET. Because evil$ has an SPN, the KDC issues a forwardable ticket. Step 5: S4U2Proxy. The attacker presents the forwardable ticket back to the KDC asking for a service ticket to HOST/TARGET on behalf of Administrator. The KDC checks msDS-AllowedToActOnBehalfOfOtherIdentity on TARGET, sees evil$ is permitted, and issues a service ticket for Administrator to any SPN running on TARGET (CIFS, HOST, HTTP, MSSQLSvc, LDAP if the target is a DC). Step 6: Lateral movement. The attacker injects the service ticket and accesses the target as Administrator. PsExec.exe \\TARGET cmd.exe runs as SYSTEM. Against a domain controller this yields DCSync, against a CA it yields the ability to issue any certificate, against a Tier 0 management host it yields full AD takeover. The entire chain runs without ever touching LSASS or triggering Credential Guard.
Cómo lo evalúa Guerrilla
Guerrilla performs three coordinated reads. First, an LDAP query for (&(|(objectClass=computer)(objectClass=msDS-GroupManagedServiceAccount))(msDS-AllowedToActOnBehalfOfOtherIdentity=*)) returns every object that currently has RBCD configured. The msDS-AllowedToActOnBehalfOfOtherIdentity octet string is parsed as a RawSecurityDescriptor and every DACL ACE is enumerated; SIDs are resolved against the local domain and trusted domains, and the trustee is classified by objectClass, group membership, whenCreated, and pwdLastSet (recently created machine accounts with no real service workload are flagged as attacker-controlled candidates). Second, the check reads the nTSecurityDescriptor on every computer object and flags non-default writers, specifically any principal outside Domain Admins, Enterprise Admins, SYSTEM, Account Operators, and Cert Publishers that holds GenericAll, GenericWrite, WriteDacl, WriteOwner, or the Validated-Write-Computer-AllowedToActOnBehalfOfOtherIdentity extended right (object GUID 3f78c3e5-f79a-46bd-a0b8-9d18116ddc79). Third, ms-DS-MachineAccountQuota is read from the domain root object; a value greater than zero combined with any unexpected RBCD writer raises the finding severity, because the attacker can self-provision the controlled SPN. Detection output includes the target computer, the principals listed in the SD, the principals with write access to the target, and the MachineAccountQuota value. When Advanced Audit Policy is enabled on the OU and the SACL on computer objects audits Write Property, the check also correlates Event 5136 (Directory Service Changes) entries for attribute LDAPDisplayName "msDS-AllowedToActOnBehalfOfOtherIdentity" from the last 90 days.
Valor recomendado
Todas las configuraciones de RBCD documentadas y auditadas. Ninguna entrada no autorizada en msDS-AllowedToActOnBehalfOfOtherIdentity. El acceso de escritura a los objetos de equipo restringido solo a administradores autorizados.
Remediación
Enumera las configuraciones de RBCD usando Get-ADComputer -Filter {msDS-AllowedToActOnBehalfOfOtherIdentity -ne '$null'} -Properties msDS-AllowedToActOnBehalfOfOtherIdentity. Revisa cada entrada por su justificación de negocio. Audita quién tiene acceso de escritura a los objetos de equipo en AD para identificar posibles rutas de abuso de RBCD. Elimina las entradas de RBCD no autorizadas. Implanta vigilancia de los cambios del atributo msDS-AllowedToActOnBehalfOfOtherIdentity.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6
- CIS AD Benchmark
- 7.3.4
- MITRE ATT&CK
- T1550.003