skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author โ†’
WebsiteGitHub

kerberos-delegation

Exploit Kerberos delegation misconfigurations in Active Directory for privilege escalation.

253|37|Updated Feb 22, 2026
Search Tags:#delegation#privilege escalation#lateral movement#kerberos#active directory#s4u#rbcd
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill kerberos-delegation
Or copy as Structured Prompt for Agentโ–ผ
Please help me install this Agent Skill.
Skill: kerberos-delegation
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/kerberos-delegation
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill kerberos-delegation

SYSTEM DOCUMENTATION & REQUIREMENTS

๐Ÿ’ก This Skill requires impacket, rubeus, bloodyAD, netexec, krbrelayx, spoolsample, petitpotam, dfscoerce, printerbug, dementor.py, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit misconfigurations in Kerberos delegation within Active Directory environments to gain higher privileges and move laterally.

Core Features & Use Cases

  • Enumerate Delegation: Discover Unconstrained, Constrained, and Resource-Based Constrained Delegation (RBCD) settings.
  • Exploit Techniques: Leverage TGT harvesting, S4U2Self/S4U2Proxy attacks, and SPN swapping.
  • Use Case: After gaining initial access, use this Skill to find a service account with Constrained Delegation and impersonate a high-privilege user to access sensitive network resources.

Quick Start

Use the kerberos-delegation skill to enumerate all unconstrained delegation targets in the current domain.

Frequently Asked Questions about kerberos-delegation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Kerberos delegation for privilege escalation in Active Directory?โ–ผ

You can exploit Kerberos delegation by leveraging misconfigurations like TGT harvesting for Unconstrained Delegation, S4U2Self and S4U2Proxy for Constrained Delegation, or RBCD via writable machine accounts to move laterally and elevate privileges.

What is the difference between unconstrained and constrained delegation attacks?โ–ผ

Unconstrained delegation attacks harvest Ticket Granting Tickets (TGTs) from servers, whereas constrained delegation attacks use S4U2Self and S4U2Proxy extensions with SPN swapping to impersonate users for specific services.

How do I perform RBCD attacks using writable machine accounts in Active Directory?โ–ผ

To perform RBCD attacks, you configure a target machine's msDS-AllowedToActOnBehalfOfOtherIdentity attribute using your writable machine account, then request service tickets via S4U to impersonate privileged users.

Can I use Rubeus and Impacket for S4U2Self and S4U2Proxy attacks?โ–ผ

Yes, you can use Rubeus and Impacket to execute S4U2Self and S4U2Proxy attacks, allowing you to impersonate high-privilege users and access sensitive network resources when domain credentials are available.

What domain credentials are required to enumerate Kerberos delegation settings?โ–ผ

Enumerating Kerberos delegation settings requires valid domain credentials to query Active Directory for Unconstrained, Constrained, and Resource-Based Constrained Delegation (RBCD) configurations.

Does Kerberos delegation exploitation work with tools like bloodyAD and NetExec?โ–ผ

Yes, Kerberos delegation exploitation works alongside tools like bloodyAD and NetExec to enumerate delegation settings and facilitate lateral movement and privilege escalation across the domain.

Related Skills

Explore More Software Engineering Skillsโ†’
wgpsecwgpsec
1.6k

adinfo-enum

Enumerate Active Directory topology, policies, and configurations via Adinfo.

Official
Intermediate
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced
Prohao42Prohao42
120

ntlm-relay-coercion

Relay NTLM authentication to SMB, LDAP, HTTP, or MSSQL targets.

Community
Advanced
younwonyyounwony

cs-sync

Synchronize CS documents to the updated CS-GUIDE.md template.

Community
Advanced