15 – AD Lateral Movement : RBCD via Generic All on WEB$

In this 15th episode, we demonstrate how to exploit Resource-Based Constrained Delegation (RBCD) using GenericAll rights on the WEB$ computer account in Active Directory. Watch as we:

Add a new computer account (evilcomputer$)

Configure RBCD so evilcomputer$ can delegate to WEB$

Impersonate the domain Administrator with S4U2Self/S4U2Proxy

Gain admin shell access on WEB$

(Optional) Create a persistent local admin for Evil-WinRM

Commands, step-by-step guide, and summary table included!
Subscribe for more AD attack & defense techniques.

#ActiveDirectory #PrivilegeEscalation #RBCD #Cybersecurity #RedTeam