What problem does it solve?
During authorized red team engagements, testers need a reliable method to abuse Kerberos Constrained Delegation misconfigurations in Active Directory, but the S4U2self/S4U2proxy attack chain involves subtle distinctions between delegation flavors that frequently cause failed exploitation attempts.
Core Features & Use Cases
- Delegation Enumeration: Identify accounts with msDS-AllowedToDelegateTo configured using PowerView, findDelegation.py, and BloodHound CE, including detection of the TRUSTED_TO_AUTH_FOR_DELEGATION protocol transition flag.
- S4U Exploitation: Execute S4U2self and S4U2proxy attacks with Rubeus on Windows or Impacket getST.py on Linux to impersonate Domain Admins against delegated services like CIFS, LDAP, and HTTP.
- Alternate Service Name Abuse: Rewrite service tickets (e.g., CIFS to LDAP) to achieve DCSync via secretsdump.py, since SPNs are not cryptographically bound to tickets.
- Use Case: During an authorized assessment, you compromise a service account with constrained delegation to a Domain Controller; use this workflow to impersonate administrator, obtain an LDAP service ticket, and perform a DCSync to achieve domain compromise.
Quick Start
Ask the AI to enumerate accounts with Kerberos Constrained Delegation in the domain and demonstrate S4U2self/S4U2proxy impersonation of a Domain Admin against the delegated CIFS service on the Domain Controller.
