So in this video we'll be talking about the constraint variation.
In the previous video we have seen unconstrained evolution.
So this one will also be similar to that, except the account only has access to particular services.
And here you can see the reason is cassava.
And we have the, uh, expense for this server and only burger options are allowed for this server.
So I have this shisha code.
It's very simple.
It's similar to the.
Instead of finding.
So what you're doing is you are finding accounts with this.
There must be a central building.
So this property, we are checking for any objects and we are printing those objects.
So the remaining is converting this control to these corresponding plugs.
We have already seen this here.
We are just printing the objects with this flag, with this attribute, not as personal.
If there is any value for this attribute of the tablet, we are going to print that object.
So let's go and run this one.
And here I can see there is only one computer.
It is delegated to the CNN office.
That is the furniture on this computer.
And here you can also see the flag procedure to the third delegation.
Now let's go and test.
So this user is normal user.
Now we need to set a change to enter service again so we can simply put service principle now.
As constrain testing.
If there is any substance on them, then this account will be like on Google Play and click on okay,
now we go and run this again.
Kirby did not find anything because we are taking a mysterious the record label.
So we need to hear this USERRA for some certain services and here and see if there are other options.
And we need to add the services to this object.
No, we cannot.
Now we need to find the user objects, our computers.
Now that at 512016.
That is a domain controller that will provide this.
That is the publisher.
Now you can see the different services offered by their domain controller now set up the CFS and click
on okay.
Now click on apply and click on.
Okay.
If you weren't on this again.
And here we get the end of the record.
That is that has to end this push to use delegated does the year of this on this when it's not local.
So that means that you delegated to access the CFS service on behalf of any user.
So after this, what we're going to do is we are going to use the reverse.
And here we have the command prompt of Pashtu.
If I go into who am I?
Groups, we are normal.
Uh.
Normal users will not need the management's.
First we need to generate the hash for this user con.
We can also dump using the memory card as well.
User testo and the password.
And specify the domain.
And now we get this cartoon for us.
Now, copy this.
And based here.
So what we're going to do is now we're going to use a Kerberos extension card.
As for you, that is self for a user.
So what this means is.
This user account can request the PDP on behalf of any other user for itself so this can impersonate
any other user for the service.
So we can use Ruby as.
As for you so do this also has this as for you.
Option to specify user that is does to and are c for hash.
And the next one is impersonating the.
We want to impersonate as administrator.
And the domain is not remarkable.
And we need to specify which service we want to ask the kids.
So for the getting the duty on behalf of on behalf of this user, then we are using this as well.
And after getting that, uh, uh, to get, we can, uh, request for their periods.
And after that we can, uh, let that to get into this memory.
So there must be yes.
SBN that is CFS trash 2016.09.0.
And after that we can use PDT.
So this was the article directly leading to the section.
Now if you hit enter and you can see to get successfully important so they can see the list of the tickets.
And here you can see we have the administrator to get it as administrator to use it to the submission
office.
Now we can go ahead and.
The contents of this.
See Drew.
So here you can see it.
We got the rest of our content.
So this is how you do the consumer delegation.
So there are there be some services need to know that those services with this, there must be an error
option.
So you will get the accounts and we can dump the hacks using mimic that and using those hash, we can
impersonate that domain administrator user.
So this is very simple, quite similar to the finding that instead of uh, uh, users were just finding
out from that remote, this one is not empty and if it's not empty were printing the San Miguel name
and the contents of this were.
This added work can also contain multiple values.
Here you can see this kind of multiple values.
So we are just moving our through that and we are just printing them.