For these, we will be talking about the Kerberos and consent delegation.
So the delegation in the sense impersonating our as other users are escalating to the higher priorities.
So let's see what is the problem for this and why there is a delegation for this.
So let's say normal user and we had a web server and we have these resources are what?
So the first one can be the file share and second one can be our like.
Backup and thoroughness database.
So we have the servers and user wants to access the resources on the servers generally the web server,
how the web server secondary which was created by the domain administrator.
So like I use web service service account and normal observers account for those accounts does not have
access to all of the resources on this service because not all the resources are the data can be accessed
by these service accounts.
So those are these accounts have this capacity.
Whenever the user wants to access his personal data on these servers, then uh, this uh, web server
will generally request to this database server and this database does not know which user is asking
for this data.
So that's why Microsoft introduces this litigation.
So in this delegation, we also have the domain controller.
So what what is going on is this user request for that device, for this Web server.
So the user will request the key duty from the domain controller.
And after that PDT, he will request further desires for this web service.
Whenever we he got the PDA for the web service, the user will be sending to this web service that PDT
inside this video.
So what this observer does is this, uh, user duty will be copied into the tedious request and will
be sent to this database server.
Uh, the database error to see the user's PDT encyclopaedias and database error identifies that this
request is coming from this user.
And, and this also checks whether the user, how the access to the particular, uh, data or not.
And then it will
send tedious and will actually fetch the data.
So this is how, uh, this operates in simple terms.
Uh, the user details will be copied, so there will be a second request from the user to domain control.
So the user will fetch this data two times, and that will result in the tedious request of this web
server to this database server.
And then afterwards, uh, now data will be transferred to this user.
No response.
So what is more rigorous and uncontrolled delegation?
I'm concerned the regression, the sense this, uh, computer, this machine, web server machine is
mitigated, uh, is trusted for delegation.
That means this web server can impersonate as any user in this domain.
Now, user, user one can, uh, try to, uh, access the data and this web server can impersonate as
this user one and then, uh, another user too.
And that can also be impersonated by this server because this web server is protected by the domain
control for deviation.
So this is the unconstrained division that there are no constraints or this variation.
Let's go to users and computers here.
We have only one computer, if you like, on this.
Go to properties and litigation and here you can see that the does have this setting by default as these
computers are dedicated to any service.
If you want to use this, you can also set the delegation permissions to the users as well.
So we'll be seeing that in the next video.
If you go to properties and go to attribute a router and go to user account control and if you edit
this one so you can see the flags on procedure for deletion.
So this is very important one, this identifies that this computer is registered a photo variation.
So we need to find for this delegation.
And here to concede the number must be a minimum fight to forward it.
We need to say to those that are going to control values for the users and then we need to query for
the facts which are minimum at this value.
And then we can convert these you control to the number for X and we can.
See them.
And here we have another flag that is too long for the reunion.
So this will be given for the U.S. elections.
So we'll be seeing this in the next year.
And the main important thing is whenever the computer restructured for the relation on these computers
at recess, protesters were articulating it in its memory.
So that means you need to have the administrator administrator privileges on this delegated mission.
Otherwise we cannot, uh, expect that to get from this.
So I tell you, it's the same computer.
And we have already the.
We are already administrator.
So generally what happens is when you do.
Wait for the administrator to access any of the service on this web server so they are disproportionately
displayed on the server so that the viewer should visit this web page and request some resource.
And after that, you will have the British terminal assets process so we can send Kerberos tickets and
we can actually export.
And here in these.
Well, tickets, you will see that we can do the parts that get attached to.
Or is an administrator.
So we can actually export them.
So it's.
So all of these tickets were placed on their desk.
So that's why it created this further.
And now you see all of these, uh, in motor tickets, so you can search for this administrator here.
You can see that we sure that you can do the passenger ticket.
So we are an administrator.
But in when we are.
-- -- has logged in to this web server and access any of the resources.
Then you will have the ticket in the memory.
Then you can dump and use this ticket.
Part of that escalation.
So this is we can write this small shop code to find the.
This brigadier computers.
So this could is similar to the previous videos of sort finding.
So are you to reason you need to change this user account control where you do this a minimum of this
photo for editor and then we loop over the properties and then we'll be converting this are you that
are going to convert to binary format and then we are of.
Trenching are the flags.
And in those flags will be.
Printing.
We are comparing if the award has the delegation and then we are printing the same Ghonim and all of
the user account contracts.
You can read this one.
So you can run this.
And here you can see I'm concerned litigation against the first one is going to 016 da.
That is the da da da.
And second one is the countries in the region where we're seeing in an actual deal and the counties
Pashtu and it also had this pressure to the for region and and the pressure for the relation.
So this is how you find border relation icons.
It's very simple.
Similar to the, uh, we are done in the finding this sort of uh, rushed were are guns.
So that's how far this video cameras are concerned.
The version you need to find what computer accounts are, user accounts, how this litigation.
And you need to also have the local administrator privileges on this machine so you can dump that against
from s memory.
And also we need to wait for the administrator to.
Log onto this web server and access the records.