SPN-jacking
Last updated
Was this helpful?
Last updated
Was this helpful?
This attack combines and DACL abuse. A service configured for Kerberos Constrained Delegation (KCD) can impersonate users on a set of services. The "set of services" is specified in the constrained delegation configuration. It is a list of SPNs (Service Principal Names) written in the msDS-AllowedToDelegateTo attribute of the KCD service's object.
In standard KCD abuse scenarios, an attacker that gains control over a "KCD service" can operate lateral movement and obtain access to the other services/SPNs. Since KCD allows for impersonation, the attacker can also impersonate users (e.g. domain admins) on the target services. Depending on the SPNs, or if it's possible to , the attacker could also gain admin access to the server the "listed SPN" belongs to.
On top of all that, if attacker is able to move a "listed SPN" from the original object to the another one, he could be able to compromise it. This is called SPN-jacking and it was intially discovered and explaine by in .
In order to "move the SPN", the attacker must have the right to edit the target object's ServicePrincipalName attribute (i.e. GenericAll, GenericWrite over the object orWriteProperty over the attribute (called WriteSPN ), etc.).
If the "listed SPN" already belongs to an object, it must be removed from it first. This would require the same privileges (GenericAll, GenericWrite, etc.) over the SPN owner as well (a.k.a. "Live SPN-jacking"). Else, the SPN can be simply be added to the target object (a.k.a. "Ghost SPN-jacking").
From UNIX-like machines, 's and example scripts (Python) can be used to conduct the different steps (manipulate SPNs, obtain and manipulate tickets).
At the time of writing, 12th Feb. 2022, adding the tgssub.py is pending. modifying the findDelegation.py is pending.
At the time of writing, 12th Feb. 2022, this technique has not been fully fool-proofed from UNIX systems. In case something errors, switch to the Windows technique.
Once the final service ticket is obtained, it can be used with / to access the target.
