search

CravateRouge / bloodyAD

BloodyAD is an Active Directory Privilege Escalation Framework
MIT License
1.12k stars 112 forks source link

RBCD attack without a SPN but using a computer account instead #10

Closed jsdhasfedssad closed 2 years ago

jsdhasfedssad commented 2 years ago

I can successfully execute an RBCD attack without involving an existing SPN and instead using a computer account I added just before this using the tool at https://github.com/tothi/rbcd-attack. I tried the same attack using your command "setRbcd" but at the stage when the silver ticket is requested Impacket fails. I didn't actually expect your tool to work since it seems it requires an SPN which I did not input. Still, I wanted to try this before contacting you. I guess this is more of a feature request than a bug report. Can your tool support this attack without needing an SPN? This would lessen the number of requirements needed for this attack to work since anyone can add computers to a domain.

rbcd1 rbcd2
CravateRouge commented 2 years ago

Good catch! It was a bug actually, the ACE wasn't right. It should work with c9bc38c

jsdhasfedssad commented 2 years ago

Very good! Now this works!