Please Describe The Problem To Be Solved
NXC already supports enumerating RBCD via --delegate, which reads msDS-AllowedToActOnBehalfOfOtherIdentity and shows which accounts have resource-based constrained delegation configured. However, there's no way to actually set this attribute through nxc.
During pentests, when you have write access to a computer object (GenericWrite, GenericAll, etc.), configuring RBCD is one of the most common privilege escalation paths. Right now you have to leave nxc and switch to a separate tool (impacket's ntlmrelayx, BloodyAD, rbcd.py, etc.) to perform the write, then come back to nxc for the rest of the engagement.
Suggest A Solution
An LDAP module (rbcd) that completes the other half of the existing --delegate enumeration. Three actions:
- read : Show current RBCD configuration on a target (which SIDs are allowed)
- write : Add a controlled account's SID to the target's allowed delegation list
- remove : Clean up by clearing the attribute after the engagement
Example usage:
nxc ldap DC01 -u user -p pass -M rbcd -o DELEGATE_TO=TARGET$ DELEGATE_FROM=YOURPC$ ACTION=write
nxc ldap DC01 -u user -p pass -M rbcd -o DELEGATE_TO=TARGET$ ACTION=read
nxc ldap DC01 -u user -p pass -M rbcd -o DELEGATE_TO=TARGET$ ACTION=remove
This chains naturally with the existing add-computer module (create a machine account via MAQ, then use it for RBCD).
Implementation notes
- Uses impacket's
ldaptypes for security descriptor construction (same approach as ntlmrelayx's delegation attack)
- Resolves sAMAccountName to SID via LDAP lookup
- Supports appending to existing RBCD config (not just overwriting)
- Cleanup action to restore original state
Happy to work on a PR if the idea is accepted.
Please Describe The Problem To Be Solved
NXC already supports enumerating RBCD via
--delegate, which readsmsDS-AllowedToActOnBehalfOfOtherIdentityand shows which accounts have resource-based constrained delegation configured. However, there's no way to actually set this attribute through nxc.During pentests, when you have write access to a computer object (GenericWrite, GenericAll, etc.), configuring RBCD is one of the most common privilege escalation paths. Right now you have to leave nxc and switch to a separate tool (impacket's ntlmrelayx, BloodyAD, rbcd.py, etc.) to perform the write, then come back to nxc for the rest of the engagement.
Suggest A Solution
An LDAP module (
rbcd) that completes the other half of the existing--delegateenumeration. Three actions:Example usage:
This chains naturally with the existing
add-computermodule (create a machine account via MAQ, then use it for RBCD).Implementation notes
ldaptypesfor security descriptor construction (same approach as ntlmrelayx's delegation attack)Happy to work on a PR if the idea is accepted.