https://wearethebug.dev/tags/constrained-delegation/Recent content on WE ARE THE BUGTradecraften-usFri, 29 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-mailservice/Fri, 29 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-mailservice/MailService is a multi-stage internal penetration test scenario that required chaining several techniques across both Linux and Windows domains.https://wearethebug.dev/posts/ertlabs-ifix-tcen-tcen/Sat, 09 Aug 2025 00:00:00 +0000https://wearethebug.dev/posts/ertlabs-ifix-tcen-tcen/Ifix-Tcen-Tcen is a famous Italian onomatopoeia and cultural reference originating from the erotic *fotoromanzi* (photo-novels) of the 1970s and 1980s. In our case it's a multi-stage internal penetration test scenario focus on Active Directory.https://wearethebug.dev/posts/vl-redelegate/Fri, 22 Nov 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-redelegate/Redelegate is a hard-difficultly Windows machine that starts with Anonymous FTP access, which allows the attacker to download sensitive Keepass Database files. The attacker then discovers that the credentials in the database are valid for MSSQL local login, which leads to enumerate SIDs and performs a password spray attack. Being a member of the HelpDesk group, the newly compromised user account Marie.Curie has a User-Force-Change-Password Access Control setup over the Helen.Frost user account; that user account has privileges to get a PS remoting session onto the Domain Controller. The Helen.Frost user account also has the SeEnableDelegationPrivilege assigned and has full control over the FS01$ machine account, essentially allowing the attacker account to modify the msDS-AllowedToDelegateTo LDAP attribute and change the password of a computer object and perform a Constrained Delegation attack.