skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-constrained-delegation-abuse

Exploits Kerberos Constrained Delegation misconfigurations via S4U2self and S4U2proxy for Active Directory privilege escalation.

1|1|Updated Apr 3, 2026
Search Tags:#red-team#active-directory#privilege-escalation#kerberos#impacket#s4u2proxy#constrained-delegation
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill exploiting-constrained-delegation-abuse-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-constrained-delegation-abuse
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/infra/exploiting-constrained-delegation-abuse
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill exploiting-constrained-delegation-abuse-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? During authorized red team engagements, testers need a structured method to identify and exploit Kerberos Constrained Delegation misconfigurations in Active Directory, which can allow impersonation of privileged users and full domain compromise. ## Core Features & Use Cases - Delegation Enumeration: Find accounts and computers with Constrained Delegation using PowerView, Impacket findDelegation.py, and BloodHound CE queries. - S4U Exploitation: Abuse S4U2self and S4U2proxy protocol extensions with Rubeus on Windows or getST.py on Linux to impersonate Domain Admins against delegated services like CIFS, LDAP, and HTTP. - Use Case: A penetration tester compromises a service account with TRUSTED_TO_AUTH_FOR_DELEGATION, requests a service ticket as Administrator to CIFS on a Domain Controller, then uses alternate service name substitution to run DCSync via secretsdump.py. ## Quick Start Ask the agent to enumerate constrained delegation accounts in the domain and exploit S4U2proxy with getST.py to impersonate the administrator against the domain controller.

Frequently Asked Questions about exploiting-constrained-delegation-abuse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Kerberos Constrained Delegation in Active Directory?▼

Enumerate accounts with msDS-AllowedToDelegateTo using PowerView or findDelegation.py, then use Rubeus s4u or Impacket getST.py with the -impersonate flag to request service tickets as a privileged user against the delegated SPN.

How to enumerate constrained delegation accounts with PowerView?▼

Run Get-DomainUser -TrustedToAuth or Get-DomainComputer -TrustedToAuth and select the msds-allowedtodelegateto property. BloodHound CE can also query objects where allowedtodelegate is not null.

Rubeus vs Impacket getST.py for S4U abuse?▼

Rubeus runs on Windows and supports combined TGT request plus S4U in one command with pass-the-ticket injection. getST.py runs on Linux, outputs a ccache file, and supports alternate service name substitution via -altservice.

Does S4U2proxy work without TRUSTED_TO_AUTH_FOR_DELEGATION?▼

Without the protocol transition flag, S4U2self produces a non-forwardable ticket and S4U2proxy fails unless Resource-Based Constrained Delegation is configured on the target. Check userAccountControl flag 0x1000000 before attempting the attack.

Why use alternate service name substitution in Kerberos tickets?▼

The service name in a Kerberos ticket is not cryptographically bound to the session key, so a ticket requested for CIFS can be reused for LDAP on the same host. This enables DCSync with secretsdump.py from a single S4U ticket.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

crackmapexec

Automate Active Directory credential spraying, enumeration, and remote command execution over SMB and WinRM.

Community
Advanced
xalgordxalgord
954

conducting-domain-persistence-with-dcsync

Perform DCSync attacks to extract Active Directory credential hashes and forge Golden Tickets.

Community
Intermediate
braydos-hbraydos-h
4

conducting-internal-reconnaissance-with-bloodhound-ce

Maps Active Directory attack paths using BloodHound CE graph analysis and Cypher queries.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

kerberos-delegation

Exploit Kerberos delegation misconfigurations in Active Directory for privilege escalation.

Official
Advanced