KrbRelayUp Privilege Escalation | Threat SnapShot

In this week's Threat SnapShot, we'll look at a new tool that was released earlier this week -- KrbRelayUp. KrbRelayUp is a universal, no-fix local privilege escalation from a low privileged domain user to local system on domain-joined computers in Windows environments. The Kerberos Relay Attack adds a fake (or owned) computer account to the target's msDS-AllowedToActOnBehalfOfOtherIdentity attribute, making it possible to perform a Resource-Based Constrained Delegation (RBCD) attack against the target. The result of the RBCD attack is Silver Ticket access to the target, which can be used for local administrator access remotely or even locally (meaning privilege escalation) by patching the Win32 Service Control Manager to use Kerberos Authentication locally.
KrbRelayUp Tool:
github.com/Dec0ne/KrbRelayUp
View this attack and analytics in the free, community edition of SnapAttack:
app.snapattack.com/session/25...
app.snapattack.com/analytic/7...
app.snapattack.com/analytic/0...
app.snapattack.com/analytic/9...