Skip to content

Commit 1fedde4

Browse files
authored
Update kerberos_unconstrained_tgt.md
1 parent 7c874c7 commit 1fedde4

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

content/kerberos_unconstrained_tgt.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ How could I use this approach with non-DC Systems to compromise `CAPSULE.CORP`?
4646

4747
## Compromising a Computer Object by its TGT
4848

49-
The first thing we should be aware of is that computer accounts don’t have logon permissions on any system by default. This means that if you manage to obtain a TGT for the `WS04$` computer account, you should not have any explicit access to the system represented by that same account (`Web01.capsule.corp` in this case).
49+
The first thing we should be aware of is that computer accounts don’t have logon permissions on any system by default. This means that if you manage to obtain a TGT for the `WS04$` computer account, you should not have any explicit access to the system represented by that same account (`WS04.capsule.corp` in this case).
5050
However, as we did with the Domain Controller TGT, we can take advantage of any permissions the computer account might have. There are two “general” straight forward scenarios:
5151
- By default, computer accounts have privileges to configure Resource-Based Constrained Delegation (RBCD) for themselves.
5252
- Computers with LAPS installed need privileges to rotate the local administrator password, which is stored in one attribute of the computer object.

0 commit comments

Comments
 (0)