DavRelayUp

From a local execution foothold on a Windows workstation joined to an Active Directory domain, DavRelayUp forces the workstation's machine account to authenticate through WebDAV and relays the NTLM exchange to LDAP when LDAP signing is not required. It sets resource-based constrained delegation (RBCD) for an available attacker-controlled computer account, obtains an impersonated local-administrator service ticket, and uses local Service Control Manager authentication to create a service running as NT AUTHORITY\SYSTEM. The operator must be able to use an existing computer account or create one, and the selected impersonated account must be a local administrator on the workstation.