Kerberos Delegation

Delegation lets a service act on behalf of a user against another service: the classic web front-end that needs to reach a database “as” the connected user. It’s a legitimate and necessary feature, but its three variants —unconstrained, constrained, and resource-based— have, when misconfigured, direct paths to impersonating any user, including Domain Admin. It’s one of the most exploited escalation vectors in modern AD.

sequenceDiagram
    participant A as Account with delegation
    participant KDC as KDC
    participant S as Target service
    A->>KDC: S4U2self (request a TGS to itself as Administrator)
    KDC-->>A: forwardable TGS as Administrator
    A->>KDC: S4U2proxy (request a TGS to the target service)
    KDC-->>A: TGS for the service as Administrator
    A->>S: access as Administrator

Threat model

The risk is impersonation: if a service can request tickets “as” another user, compromising that service (or the account/computer hosting it) lets you impersonate anyone who uses it or, in some cases, any domain user. Kerberos’s S4U (Service-for-User) feature is the piece attackers abuse to forge that impersonation.

The three variants

Unconstrained Delegation

A computer/account with this flag receives, when a user connects to it, a copy of the user’s TGT in its memory. Compromise that host and you extract the TGTs of everyone who connected, admins included.

# locate computers with unconstrained
Get-DomainComputer -Unconstrained
# on the compromised host, dump TGTs
Rubeus.exe monitor /interval:5     # or sekurlsa::tickets

The lethal play: coerce a DC (PrinterBug/PetitPotam) to connect to your unconstrained host → capture the DC’s TGT → DCSync → domain.

Constrained Delegation

The account can delegate only toward specific SPNs (msDS-AllowedToDelegateTo). With S4U2Self + S4U2Proxy it can request a ticket “as any user” toward those services. If you control an account with constrained delegation, you impersonate anyone (e.g. Administrator) against the allowed service.

getST.py -spn cifs/target -impersonate Administrator domain/svc:pass
# or Rubeus s4u /user:svc /rc4:hash /impersonateuser:Administrator /msdsspn:cifs/target /ptt

Key detail: protocol transition (TrustedToAuthForDelegation) lets you impersonate without the user authenticating first; and the target SPN can be manipulated (change the service part) to jump to other services on the same host.

Resource-Based Constrained Delegation (RBCD)

Here control sits on the target resource: its msDS-AllowedToActOnBehalfOfOtherIdentity attribute lists who may delegate to it. If you have write permission over a computer (GenericAll/GenericWrite/WriteProperty), configure RBCD to an account you control → impersonate any user against that computer.

# 1) create/use a machine account you control (MachineAccountQuota default 10)
addcomputer.py -computer-name ATK$ -computer-pass Pass123 domain/user:pass
# 2) write RBCD on the target
rbcd.py -delegate-from 'ATK$' -delegate-to 'VICTIM$' -action write domain/user:pass
# 3) S4U to impersonate admin against the target
getST.py -spn cifs/victim.domain -impersonate Administrator -hashes :hash 'domain/ATK$'

RBCD is the favorite destination of NTLM relay to LDAP (NTLM Relay): relay a machine account to the DC and write RBCD → impersonation.

Tools

• Rubeus (s4u, monitor, tgtdeleg) — delegation from Windows.
• impacket (getST.py, rbcd.py, findDelegation.py, addcomputer.py).
• PowerView (Get-DomainComputer -Unconstrained, Get-DomainUser -TrustedToAuth).
• BloodHound — flags delegations and routes using them.

Impact

Impersonation of any user (DA included), and in unconstrained + DC coercion, full domain compromise. RBCD via relay or via ACL is one of the most reliable roads to DA today.

Blue Team

Detection

• 4769 (TGS) with unusual S4U flags; S4U2Self/S4U2Proxy tickets from accounts that shouldn’t delegate.
• Unexpected writes to msDS-AllowedToActOnBehalfOfOtherIdentity (RBCD) and msDS-AllowedToDelegateTo (attribute-change auditing).
• New machine-account creation (MachineAccountQuota) by normal users; coercion toward unconstrained hosts.

Telemetry

Audit delegation-attribute changes on the DC, computer creation (4741), and correlate anomalous S4U. Periodic BloodHound to inventory delegations.

Hardening

• Remove unconstrained delegation; where needed, use constrained or scoped RBCD.
• Mark sensitive accounts (DA/Tier 0) as “Account is sensitive and cannot be delegated” and put them in Protected Users → not delegatable.
• Set MachineAccountQuota = 0 (stops users creating machine accounts for RBCD).
• Enforce LDAP signing + channel binding (cuts the LDAP relay enabling RBCD).
• Audit and minimize who has write over computer objects (BloodHound).

Response

Revert malicious RBCD/constrained writes, reset delegating accounts, remove attacker-created machine accounts, and if DA/krbtgt was impersonated, treat the domain as compromised (rotate krbtgt ×2).

CVEs and real-world cases

• Unconstrained + PrinterBug (SpoolSample) → capture of a DC’s TGT: a heavily used public chain to DA.
• Bronze Bit (CVE-2020-17049) — bypass of delegation protections in S4U2Self.
• RBCD via NTLM relay to LDAP (Elad Shamir, “Wagging the Dog”) — the reference technique.
• MITRE T1558.003 and delegation abuses documented in red-team and ransomware reports.

Testing checklist

• Computers with unconstrained delegation (Get-DomainComputer -Unconstrained)
• Coercion of a DC toward an unconstrained host? (DC TGT)
• Accounts with constrained delegation (msDS-AllowedToDelegateTo)
• S4U2Self/S4U2Proxy to impersonate Administrator
• Write over computer objects? → RBCD
• MachineAccountQuota > 0 (create account for RBCD)
• RBCD via NTLM relay to LDAP
• Blue: Protected Users and “cannot be delegated” on Tier 0?

References

• HackTricks — Constrained delegation
• HackTricks — Resource based constrained delegation
• Rubeus — GhostPack (GitHub)
• MITRE ATT&CK — 003