attacking-kerberos-delegation

Attacking Kerberos Delegation

Delegation lets a service impersonate users to other services. Every form of it is a controlled way to become someone else, and each has a misconfiguration that removes the control. RBCD in particular turns a common, low-looking permission — write access to a computer object — into full compromise of that host, which is why it is the delegation attack that comes up most.

Only against domains you are authorized to test.

When to Use

• BloodHound flags Unconstrained, Constrained, or RBCD delegation
• You control an account with an SPN, or GenericWrite/GenericAll over a computer object
• You can create machine accounts (default MachineAccountQuota is 10)
• You control a host configured for delegation
• Reviewing delegation configuration defensively

When NOT to Use

• Certificate Services abuse — use abusing-adcs
• Kerberoasting, DCSync, general AD — use attacking-active-directory
• Entra ID — use attacking-entra-id
• Detection — use engineering-detections; TGS/S4U patterns and machine account creation (4741) are the telemetry

Enumerate the Three Types

# Constrained + unconstrained in one pass
findDelegation.py domain.local/user:pass -dc-ip 10.0.0.10        # impacket
# PowerView
Get-DomainComputer -Unconstrained | select name
Get-DomainComputer -TrustedToAuth | select name,msds-allowedtodelegateto
Get-DomainUser -TrustedToAuth
# RBCD is a per-object attribute; BloodHound's edges are the practical way to find it

Which type you are looking at decides everything:

Unconstrained Delegation