Skip to content
PowerShell module to play with Kerberos S4U extensions
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE
Mystique.ps1
Mystique.psd1
Mystique.psm1
README.md

README.md

Mystique

PowerShell tool to play with Kerberos S4U extensions

This module can assist blue teams to identify risky Kerberos delegation configurations as well as red teams to impersonate arbitrary users by leveraging KCD with Protocol Transition

More info on Black hat slides: https://www.slideshare.net/MatanHart/delegate-to-the-top-abusing-kerberos-for-arbitrary-impersonations-and-rce

Usage

Install the module

Import-Module .\Mystique.psm1

Or just load the script (you can also IEX from web)

. .\Mystique.ps1

Make sure Set-ExecutionPolicy is Unrestricted or Bypass

Get information about a function

Get-Help Find-DelegationAccounts -Full

All fucntions also have -Verbose mode

Functions

Add-SeTcbPrivilege      - Adds the "act as part of the operating system" (SeTcbPrivilege) privilege to a user
Find-DelegationAccounts - Find accounts that are trusted for Kerberos delegation
Get-CurrentIdentity     - Retreives information about the current identity
New-Impersonation       - Impersonate a user using Protocol Transition
Read-DelegatedFlag      - Checks if a user or users in a specific group can be delegated
Undo-Impersonation      - Reverts an impersonated session to the original account
You can’t perform that action at this time.