Kerberos Delegation Abuse

Kerberos delegation lets a service impersonate a user onward to a second service — e.g. a web server pulling the user’s mailbox from Exchange as that user. It exists so multi-tier apps work without re-prompting for credentials, and every variant is abusable when configured carelessly. The three flavors:

Variant	Configuration	Abuse
Unconstrained	Computer/user trusted for delegation to any service	Host holds visitors’ forwardable TGTs in memory; a compromised print-server-style host (or one coerced into authenticating to you, e.g. PrinterBug) yields DA TGTs 1
Constrained	msDS-AllowedToDelegateTo lists specific SPNs	S4U2self + S4U2proxy chain: the account can mint service tickets as any user to its allowed services 2
Resource-based (RBCD)	Target resource’s msDS-AllowedToActOnBehalfOfOtherIdentity names who may delegate to it	Attacker who can write that attribute on a computer object takes the host (Elad Shamir’s “Wagging the Dog”, 2019) 3 4

• MITRE: T1558 — Steal or Forge Kerberos Tickets, T1550.003 — Pass the Ticket ^{5 6}

Unconstrained delegation exploitation

Unconstrained is the original, bluntest flavor: when a host is “trusted for delegation to any service,” the KDC hands every user who authenticates to it a forwardable copy of their TGT, which the host caches in LSASS. Compromise the host, harvest the tickets: ⁷

# Find delegation-enabled computers (PowerView)
Get-NetComputer -Unconstrained
 
# On the compromised host: dump cached Kerberos tickets
Invoke-Mimikatz -Command '"sekurlsa::tickets /export"'
 
# Find a privileged user's .kirbi in the export, then pass-the-ticket
Invoke-Mimikatz -Command '"kerberos::ptt C:\temp\[0;12345]-2-0-60a10000-DA@krbtgt.kirbi"'

The missing ingredient is getting a valuable user to authenticate to your host. Two classic plays:

• Wait and watch — unconstrained-delegation hosts are often print servers, Citrix/VDI gateways, or other services admins touch constantly; a Domain Admin’s TGT eventually lands in memory on its own.
• Coerce authentication — force a DC or admin host to connect to you via the PrinterBug (MS-RPRN RpcRemoteFindFirstPrinterChangeNotification) or PetitPotam-style coercion. The DC’s computer account TGT arrives — which is itself enough to DCSync and own the domain. (Rubeus’s monitor mode catches the incoming ticket in real time.)

Defense is asymmetric and easy: never enable unconstrained delegation on anything (constrained/RBCD are strictly narrower), and mark privileged accounts “Account is sensitive and cannot be delegated” (or Protected Users) so their TGTs are never forwardable in the first place — coercion then yields nothing reusable. Detection watches for TGT requests with the forwardable flag from accounts that shouldn’t be delegating (Event 4768/4769 anomalies). ⁸

Constrained delegation exploitation

Constrained delegation was supposed to be the safe option — the account may only delegate to an explicit SPN list. But the S4U (Service-for-User) extensions break that intuition: ⁹

1. S4U2self — a service with the TrustedToAuthForDelegation (T2A4D) bit may ask the KDC for a service ticket to itself as any user, no credential required. If protocol transition is allowed, this works for arbitrary users including Domain Admins.
2. S4U2proxy — the service then exchanges that ticket for a ticket to one of its allowed SPNs, still as the impersonated user.

So compromising any account (user or computer) configured for constrained delegation with protocol transition is effectively compromising every service on its allowed list — as any user. Harmj0y’s S4U2Pwnage write-up and the s4u command in Rubeus (adapted from Benjamin Delpy’s Kekeo) operationalized this. ¹⁰

Execution

# Find delegation-enabled principals (PowerView)
Get-DomainUser    -TrustedToAuth
Get-DomainComputer -TrustedToAuth
 
# Having compromised $TARGET_USER (e.g. via kerberoasting — see below),
# run the full S4U chain and inject the resulting ticket:
Rubeus.exe s4u /user:$TARGET_USER /rc4:$TARGET_USER_NTLM_HASH `
               /impersonateuser:$DOMAIN_ADMIN `
               /msdsspn:$SPN_ALLOWED_FOR_DELEGATION /ptt

/altservice:$SERVICE requests the ticket for an alternate service on the same host — the KDC treats services on one machine as interchangeable because they all map to the host’s keys. Useful values: host (WMI/scheduled tasks), http (PSRemoting), cifs (file access), ldap (DCSync — only against a DC, since LDAP delegation to a DC’s LDAP service enables replication rights).

Post-exploitation

With LDAP access to a DC (or any DA-equivalent path), DCSync krbtgt to convert delegation access into golden tickets:

Invoke-Mimikatz -Command '"lsadump::dcsync /user:$DOMAIN\krbtgt"'

Why the pieces fall into place

Constrained-delegation accounts are often service accounts with SPNs — meaning they’re kerberoastable. The chain writes itself: kerberoast the service account → S4U2self/S4U2proxy as a Domain Admin → DCSync → golden ticket. Accounts without protocol transition (constrained delegation, Kerberos-only) are narrower but still abusable via RBCD-style tricks. ¹¹

Resource-based constrained delegation (RBCD)

RBCD flips the delegation direction: instead of the front-end account listing what it may delegate to, the target resource lists who may delegate to it in msDS-AllowedToActOnBehalfOfOtherIdentity. Elad Shamir’s 2019 research showed two critical things: ¹²

1. S4U2self works on any account with an SPN, regardless of TrustedToAuthForDelegation; the resulting TGS just isn’t forwardable.
2. RBCD does not require a forwardable TGS for S4U2proxy — so any SPN’d account (including a freshly created computer account via MachineAccountQuota) can be used to compromise a host whose msDS-AllowedToActOnBehalfOfOtherIdentity you can write.

The practical chain: GenericWrite/GenericAll/WriteDacl on a computer object → write a controlled machine account’s SID into its RBCD attribute → Rubeus s4u → host takeover. Harmj0y’s case study demonstrates this end-to-end against a domain controller. ¹³

Detection & defense

• Event 4769 anomalies: S4U2self requests followed by S4U2proxy, service tickets requested for users who never logged into the requesting service, or tickets for sensitive SPNs from unexpected accounts.
• Inventory every principal with T2A4D / msDS-AllowedToDelegateTo set and justify each; remove delegation from anything that doesn’t strictly need it.
• Mark privileged accounts “Account is sensitive and cannot be delegated” (or add them to Protected Users) so S4U2self fails for them.
• Never put delegation-enabled accounts in high-privilege groups, and use strong / gMSA passwords since these accounts are prime kerberoasting targets.
• Audit write access (GenericAll, GenericWrite, WriteDacl, WriteOwner) on computer objects — RBCD makes these equivalent to host compromise. ¹⁴

Related: kerberos, kerberoasting, golden-and-silver-ticket-attacks, rubeus, active-directory-trust-pivoting.

Sources

• harmj0y — S4U2Pwnage (2017)
• harmj0y — Another Word on Delegation (2018)
• adsecurity.org — Kerberos Unconstrained Delegation (Sean Metcalf, 2015)
• Elad Shamir / Shenanigans Labs — Wagging the Dog: Abusing Resource-Based Constrained Delegation (2019)
• harmj0y — A Case Study in Wagging the Dog: Computer Takeover (2019)
• MITRE ATT&CK T1558 — Steal or Forge Kerberos Tickets
• MITRE ATT&CK T1550.003 — Pass the Ticket

Footnotes

1. adsecurity.org — Kerberos Unconstrained Delegation (Sean Metcalf, 2015) ↩

2. harmj0y — S4U2Pwnage (2017) ↩

3. Elad Shamir / Shenanigans Labs — Wagging the Dog: Abusing Resource-Based Constrained Delegation (2019) ↩

4. harmj0y — Another Word on Delegation (2018) ↩

5. MITRE ATT&CK T1558 — Steal or Forge Kerberos Tickets ↩

6. MITRE ATT&CK T1550.003 — Pass the Ticket ↩

7. adsecurity.org — Kerberos Unconstrained Delegation (Sean Metcalf, 2015) ↩

8. adsecurity.org — Kerberos Unconstrained Delegation (Sean Metcalf, 2015) ↩

9. harmj0y — S4U2Pwnage (2017) ↩

10. harmj0y — S4U2Pwnage (2017) ↩

11. harmj0y — Another Word on Delegation (2018) ↩

12. Elad Shamir / Shenanigans Labs — Wagging the Dog: Abusing Resource-Based Constrained Delegation (2019) ↩

13. harmj0y — A Case Study in Wagging the Dog: Computer Takeover (2019) ↩

14. Elad Shamir / Shenanigans Labs — Wagging the Dog: Abusing Resource-Based Constrained Delegation (2019) ↩