If we can compromise a machine with unconstrained delegation, we can extract any TGTs from its memory and use them to impersonate the users against other services in the domain.
Dump all permitted computers
(Domain Controllers are always permitted for unconstrained delegation.)
Force the domain controller to authenticate to the web server to steal its TGT
Cache tickets
Where: DC-2 is the "target"
WEB is the "listener"
Rubeus will then capture the ticket.
Either use this for S4U2Self abuse -> S4U2Self Abuse, or ->
Inject the ticket into memory
With the TGT of the domain controller machine account injected into memory, we can perform actions in the context of that TGT. However, the CDC01$ account is not a local administrator on the domain controller so we cannot directly perform lateral movement with it.
On the other hand, the account has domain replication permissions, which means we can perform dcsync and dump the password hash of any user.
Let's use Mimikatz to perform DCSync (utilizing kiwi for AV evasion)
In this case we grabbed the hash of a DA, could also grab hash of krbtgt
