Impacket rbcd.py

Back to the Category Index / Back to the Command Index

Overview

Reads a computer account’s msDS-AllowedToActOnBehalfOfOtherIdentity attribute and adds or removes accounts allowed to delegate to it.

Item	Details
Implementation	examples/rbcd.py
Category	Active Directory / LDAP / Account Management
Size	331 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/rbcd.py -h for the current option definitions.

Argument	Description
identity	domain.local/username[:password]
-delegate-to	Target account whose DACL is read or changed (required).
-delegate-from	Account controlled by the attacker to add to -delegate-to’s RBCD property (with -action write).
-action	Operation on msDS-AllowedToActOnBehalfOfOtherIdentity (choices: read, write, remove, flush; default: read).
-ldaps / -use-ldaps	Use LDAPS instead of LDAP.
-ts	Add timestamps to log output.
-debug	Enable debug logging.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.
-dc-ip	Domain controller or Kerberos KDC IP address. Defaults to the domain (FQDN) in identity.
-dc-host	Domain controller or Kerberos KDC hostname. Uses -dc-ip if omitted.

Related technology: self-relative security descriptors in LDAP and S4U2proxy / PA_PAC_OPTIONS in Kerberos.

Detailed Processing Flow

The command resolves delegate-to and delegate-from to SIDs through LDAP and retrieves the target attribute’s security descriptor. read displays permitted SIDs; write adds an allow ACE; remove deletes the matching ACE; flush writes back an empty descriptor.

How It Works

RBCD permissions are stored on the destination computer object, not on the delegating account, in msDS-AllowedToActOnBehalfOfOtherIdentity. The value is a self-relative security descriptor, not a simple SID array. read parses its DACL and displays allow ACE trustee SIDs as account names.

write obtains the delegate-from SID and creates an allow ACE with the required access mask, appending it to the existing DACL. remove deletes only ACEs for the specified SID; flush clears the entire attribute. The difference is whether other existing delegates are retained.

A binary descriptor passed to LDAP modify must have consistent revision, owner/group, ACL size, and ACE count. Check that parsing and serialization round-trip without losing existing information, including duplicate ACEs, unknown ACEs, and unresolved SIDs.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
RBCD	69	__init__(), read(), write(), remove(), flush(), get_allowed_to_act(), get_user_info(), get_sid_info()
create_empty_sd()	36	Module function
create_allow_ace()	56	Module function
parse_args()	258	Module function
main()	300	Module function

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.examples	logger, utils
impacket.ldap	ldaptypes
impacket.examples.utils	init_ldap_session, parse_identity

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
ldap3	ldap3	Imported directly; declared dependency
ldapdomaindump	ldapdomaindump	Imported directly; declared dependency

Output, Side Effects, and Required Privileges

• Some operations change the target’s state. Confirm the target name, SID, and path before making changes.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on ldap3, ldapdomaindump, and ldaptypes. create_empty_sd() and create_allow_ace() build the binary descriptor. Keep actions that preserve existing ACEs distinct from clearing everything.

Verification

• Syntax: python -m py_compile examples/rbcd.py
• CLI: python examples/rbcd.py -h
• Related test: tests/SMB_RPC/test_ldap.py