RBCD abuse module (write msDS-AllowedToActOnBehalfOfOtherIdentity) #1219

Please Describe The Problem To Be Solved

NXC already supports enumerating RBCD via --delegate, which reads msDS-AllowedToActOnBehalfOfOtherIdentity and shows which accounts have resource-based constrained delegation configured. However, there's no way to actually set this attribute through nxc.

During pentests, when you have write access to a computer object (GenericWrite, GenericAll, etc.), configuring RBCD is one of the most common privilege escalation paths. Right now you have to leave nxc and switch to a separate tool (impacket's ntlmrelayx, BloodyAD, rbcd.py, etc.) to perform the write, then come back to nxc for the rest of the engagement.

Suggest A Solution

An LDAP module (rbcd) that completes the other half of the existing --delegate enumeration. Three actions:

• read : Show current RBCD configuration on a target (which SIDs are allowed)
• write : Add a controlled account's SID to the target's allowed delegation list
• remove : Clean up by clearing the attribute after the engagement

Example usage:

nxc ldap DC01 -u user -p pass -M rbcd -o DELEGATE_TO=TARGET$ DELEGATE_FROM=YOURPC$ ACTION=write
nxc ldap DC01 -u user -p pass -M rbcd -o DELEGATE_TO=TARGET$ ACTION=read
nxc ldap DC01 -u user -p pass -M rbcd -o DELEGATE_TO=TARGET$ ACTION=remove

This chains naturally with the existing add-computer module (create a machine account via MAQ, then use it for RBCD).

Implementation notes

• Uses impacket's ldaptypes for security descriptor construction (same approach as ntlmrelayx's delegation attack)
• Resolves sAMAccountName to SID via LDAP lookup
• Supports appending to existing RBCD config (not just overwriting)
• Cleanup action to restore original state

Happy to work on a PR if the idea is accepted.