Skip to content

Commit 6b81bec

Browse files
phacktphackt
committed
look for dangerous rights on computers with T4D
1 parent 5bec039 commit 6b81bec

File tree

2 files changed

+40
-31
lines changed

2 files changed

+40
-31
lines changed

‎Invoke-Recon.ps1‎

Lines changed: 37 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -334,10 +334,7 @@ Write-Banner -Text "Is LAPS installed (CN=ms-mcs-admpwd,$($RootDSE.schemaNamingC
334334
$islaps = Get-DomainObject "ms-Mcs-AdmPwd" -SearchBase "$($RootDSE.schemaNamingContext)"
335335

336336
if($islaps){
337-
Write-ColorOutput green "`r`n[+] LAPS installed"
338-
}else
339-
{
340-
Write-ColorOutput red "`r`n[!] LAPS not installed"
337+
Write-ColorOutput green "`r`n[+] LAPS schema extension detected"
341338
}
342339

343340
# If -Quick, skipping what can take a lot of time on large domains
@@ -469,7 +466,7 @@ foreach($ExchangeServer in $ExchangeServers){
469466

470467
#Checking if server is vuln
471468
if($ExchangeServer.PrivExchange -eq $true){
472-
Write-ColorOutput yellow "[!] Exchange server $($ExchangeServer.FQDN) vulnerable to PrivExchange"
469+
Write-ColorOutput yellow "[!] Exchange server $($ExchangeServer.FQDN) vulnerable to PrivExchange"
473470
}
474471

475472
#Checking if server is vuln
@@ -545,7 +542,30 @@ if($KerberoastableUsers){
545542
#
546543

547544
Write-Banner -Text "Computers with unconstrained delegation - skip DCs"
548-
Get-ADComputer -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {(TrustedForDelegation -eq $True) -AND (PrimaryGroupID -eq 515)} -Properties TrustedForDelegation,servicePrincipalName,Description | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\unconstrained_computers" -Tee
545+
$computers_with_T4D = Get-ADComputer -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {(TrustedForDelegation -eq $True) -AND (PrimaryGroupID -eq 515)} -Properties TrustedForDelegation,servicePrincipalName,Description
546+
$computers_with_T4D | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\unconstrained_computers" -Tee
547+
548+
Write-Banner -Text "Looking for dangerous rights on computers with unconstrained delegation"
549+
550+
$computers_with_T4D_and_additionaldnshostnames_writable = ($computers_with_T4D |foreach {
551+
Get-DomainObjectAcl "$($_.DistinguishedName)" -ResolveGUIDs | ?{
552+
($_.AceQualifier -match 'AccessAllowed') -and `
553+
($_.SecurityIdentifier -match '^S-1-5-.*-[0-9]\d{3,}$') -and ( `
554+
($_.ObjectAceType -ilike 'User-*Change-Password') -or `
555+
($_.ActiveDirectoryRights -imatch 'GenericAll|GenericWrite|WriteDacl|WriteOwner') -or `
556+
(($_.ActiveDirectoryRights -imatch 'WriteProperty') -and ($_.ObjectAceType -imatch 'ms-DS-Additional-Dns-Host-Name')))
557+
} | % {
558+
$_ | Add-Member Noteproperty 'TrusteeDN' $(Convert-ADName $_.SecurityIdentifier -OutputType DN)
559+
$_ | ?{ $_.TrusteeDN -inotlike '*OU=Microsoft Exchange Security Groups*' }
560+
}
561+
})
562+
563+
if($computers_with_T4D_and_additionaldnshostnames_writable){
564+
$computers_with_T4D_and_additionaldnshostnames_writable
565+
566+
Write-ColorOutput yellow "[!] Found computers with unconstrained delegation and dangerous rights"
567+
Write-ColorOutput yellow "[!] For WriteProperty on ms-DS-Additional-Dns-Host-Name, please check https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/"
568+
}
549569

550570
Write-Banner -Text "Users with unconstrained delegation"
551571
Get-ADUSer -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {(TrustedForDelegation -eq $True)} -Properties TrustedForDelegation,servicePrincipalName,Description | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\unconstrained_users" -Tee
@@ -556,31 +576,19 @@ Get-ADServiceAccount -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC
556576
#
557577
# Kerberos delegation - constrained
558578
#
559-
560-
Write-Banner -Text "Computers with constrained delegation"
561-
Get-ADComputer -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {msDS-AllowedToDelegateTo -like '*'} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation,servicePrincipalName,Description | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\constrained_computers" -Tee
562-
563-
Write-Banner -Text "Users with constrained delegation"
564-
Get-ADUser -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {msDS-AllowedToDelegateTo -like '*'} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation,servicePrincipalName,Description | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\constrained_users" -Tee
565-
566-
Write-Banner -Text "Managed Service Accounts with constrained delegation"
567-
Get-ADServiceAccount -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {msDS-AllowedToDelegateTo -like '*'} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation,servicePrincipalName,Description | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\constrained_msa" -Tee
568-
569-
#
570-
# Kerberos delegation - constrained with protocol transition
571-
#
572-
# https://phackt.com/delegation-contrainte-kerberos-avec-transition-protocole
579+
# https://phackt.com/en-kerberos-constrained-delegation-with-protocol-transition
573580
#
574581

575-
Write-Banner -Text "Computers with constrained delegation and protocol transition"
582+
Write-Banner -Text "Computers with constrained delegation"
576583
Get-ADComputer -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {TrustedToAuthForDelegation -eq $True} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation,servicePrincipalName,Description | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\constrained_t2a4d_computers" -Tee
577584

578-
Write-Banner -Text "Users with constrained delegation and protocol transition"
585+
Write-Banner -Text "Users with constrained delegation"
579586
Get-ADUser -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {TrustedToAuthForDelegation -eq $True} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation,servicePrincipalName,Description | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\constrained_t2a4d_users" -Tee
580587

581-
Write-Banner -Text "Managed Service Accounts with constrained delegation and protocol transition"
588+
Write-Banner -Text "Managed Service Accounts with constrained delegation"
582589
Get-ADServiceAccount -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC -Filter {TrustedToAuthForDelegation -eq $True} -Properties msDS-AllowedToDelegateTo,TrustedToAuthForDelegation,servicePrincipalName,Description | Format-KerberosResults | Output-Results -Path "$QuickWinsDir\constrained_t2a4d_msa" -Tee
583590

591+
584592
#
585593
# Find services with msDS-AllowedToActOnBehalfOfOtherIdentity
586594
#
@@ -598,12 +606,13 @@ Get-ADServiceAccount -SearchBase $RootDSE.defaultNamingContext -Server $TargetDC
598606
# Find principals (RID >= 1000) with permissive rights
599607
#
600608

601-
$containers = @("$($RootDSE.defaultNamingContext)","CN=Users,$($RootDSE.defaultNamingContext)","CN=Computers,$($RootDSE.defaultNamingContext)")
609+
$containers = @("$($RootDSE.defaultNamingContext)","CN=Users,$($RootDSE.defaultNamingContext)","CN=Computers,$($RootDSE.defaultNamingContext)","OU=Domain Controllers,$($RootDSE.defaultNamingContext)")
602610

603611
$containers |foreach {
604612

605-
Write-Banner -Text "Finding principals (RID > 1000) with permissive rights on '$_' (DS-Replication-Get-Changes-All|WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner|User-Change-Password|User-Force-Change-Password)"
606-
Write-Output "[!] Filtering out 'OU=Microsoft Exchange Security Groups'"
613+
Write-Banner -Text "Finding principals (RID > 1000) with permissive rights on container '$_' (not looking for nested objects)"
614+
615+
# Write-Output "[!] Filtering out 'OU=Microsoft Exchange Security Groups'"
607616

608617
Get-DomainObjectAcl "$_" -ResolveGUIDs | ?{
609618
($_.AceQualifier -match 'AccessAllowed') -and `
@@ -612,8 +621,8 @@ $containers |foreach {
612621
($_.ObjectAceType -ilike 'User-*Change-Password') -or `
613622
($_.ActiveDirectoryRights -imatch 'WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner'))
614623
} | % {
615-
$_ | Add-Member Noteproperty 'PrincipalDN' $(Convert-ADName $_.SecurityIdentifier -OutputType DN)
616-
$_ | ?{ $_.PrincipalDN -inotlike '*OU=Microsoft Exchange Security Groups*' }
624+
$_ | Add-Member Noteproperty 'TrusteeDN' $(Convert-ADName $_.SecurityIdentifier -OutputType DN)
625+
$_ | ?{ $_.TrusteeDN -inotlike '*OU=Microsoft Exchange Security Groups*' }
617626
} | Output-Results -Path "$QuickWinsDir\permissive_acls" -Tee
618627
}
619628

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ git clone --recurse-submodules https://github.com/phackt/Invoke-Recon.git && cd
2222
- Privileged users with RID >= 1000 (recursive lookups for nested members of privileged groups, not AdminCount = 1 to avoid orphans)
2323
- DNSAdmins group members
2424
- Principals with :
25-
- unconstrained delegation (T4D)
25+
- unconstrained delegation
26+
- looking for dangerous rights on computers with unconstrained delegation, see [https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/](https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/)
2627
- constrained delegation (also resource based - msDS-AllowedToActOnBehalfOfOtherIdentity)
27-
- constrained delegation with protocol transition (T2A4D)
2828
- Exchange servers
2929
- confirm WriteDAC on root domain without InheritOnly
3030
- list users with mailboxes
@@ -38,7 +38,7 @@ git clone --recurse-submodules https://github.com/phackt/Invoke-Recon.git && cd
3838
- Computers with deprecated OS
3939
- Users with Kerberos PreAuth disables (AS_REP Roasting)
4040
- Kerberoastable users
41-
- Principals (RID >= 1000) with the following rights on **root domain**, **CN=Users** and **CN=Computers** containers:
41+
- Principals (RID >= 1000) with the following rights on the **root domain**, **Users**, **Computers** and **Domain Controllers** containers:
4242
- DS-Replication-Get-Changes-All|WriteProperty|GenericAll|GenericWrite|WriteDacl|WriteOwner|User-Change-Password|User-Force-Change-Password
4343

4444

0 commit comments

Comments
 (0)