非约束委派

NetExec 允许你获取所有带有 TRUSTED_FOR_DELEGATION 标志的计算机和用户列表

nxc ldap 192.168.0.104 -u harry -p pass --trusted-for-delegation

替代工具

GitHub - ropnop/windapsearch: Python script to enumerate users, groups and computers from a Windows domain through LDAP queriesGitHub

PowerSploit/Recon/PowerView.ps1 at dev · PowerShellMafia/PowerSploitGitHub

资源:

https://troopers.de/downloads/troopers19/TROOPERS19_AD_Fun_With_LDAP.pdftroopers.de

Unconstrained Delegation - Risqueshackndo

“Relaying” Kerberos - Having fun with unconstrained delegationdirkjanm.io

Hunting in Active Directory: Unconstrained Delegation & Forests Trusts - SpecterOpsSpecterOps