Bug: AllExtendedRights Abuse Info is Incorrect

[logangoins]

Description:

The AllExtendedRights abuse info in the Bloodhound documentation and UI showcase objects with an AllExtendedRights relationship being vulnerable to Resource-Based Constrained Delegation (RBCD), which is incorrect. An example is found here of the issue under the computer section: https://support.bloodhoundenterprise.io/hc/en-us/articles/17312860666267-AllExtendedRights. Write access to msDs-AllowedToActOnBehalfOfOtherIdentity is not permitted when configuring AllExtendedRights, restricting the exploitation of RBCD.

AllExtendedRights grants the affected object and configured principal access to the objects ExtendedRights, with a few examples defined in the Microsoft documentation here: https://learn.microsoft.com/en-us/windows/win32/adschema/extended-rights. ReadLAPSPassword for computer objects (if the computers have LAPS) would be a much more appropriate example in the abuse section.

Component(s) Affected:

• UI
• Documentation

Steps to Reproduce:

Bloodhound UI:

1. Ingest an AllExtendedRights relationship through Bloodhound
2. Click on the text for the relationship "AllExtendedRights" to open the help menu and abuse info.
3. Note the abuse info on the right containing exploitation steps for RBCD on Windows and Linux platforms.

Documentation:

1. Visit the docs on the AllExtendedRights edge case here: https://support.bloodhoundenterprise.io/hc/en-us/articles/17312860666267-AllExtendedRights
2. Note under the computer category the mention of RBCD.

Screenshots/Code Snippets/Sample Files: