active-directory-constrained-delegation

name

active-directory-constrained-delegation

description

How to enumerate and exploit Kerberos Constrained Delegation in Active Directory for privilege escalation. Use this skill whenever the user mentions constrained delegation, S4U2self, S4U2proxy, msDS-AllowedToDelegateTo, TrustedToAuthForDelegation, Kerberos delegation attacks, or any scenario involving service account impersonation in AD environments. Also trigger for Rubeus s4u commands, Impacket getST with altservice, or when investigating delegation-based privilege escalation paths.

Active Directory Constrained Delegation Exploitation

This skill covers enumeration and exploitation of Kerberos Constrained Delegation misconfigurations in Active Directory environments.

What is Constrained Delegation

Constrained delegation allows a Domain Admin to permit a computer or service account to impersonate users against specific services on designated machines. When compromised, this enables:

• S4U2self: Service account obtains TGS for itself on behalf of any user
• S4U2proxy: Service account obtains TGS on behalf of any user to services listed in msDS-AllowedToDelegateTo

Key insight: If you compromise the hash of a service account with constrained delegation enabled, you can impersonate users and access services on their behalf — often leading to privilege escalation.

Critical Limitations

• Users marked as "Account is sensitive and cannot be delegated" cannot be impersonated
• SPN swapping weakness: If you have access to one service (e.g., CIFS), you can often access others (e.g., HOST, LDAP) using /altservice flag
• LDAP access on DC enables DSync attacks

Cross-Domain Delegation (2025+)

Windows Server 2012+ supports constrained delegation across domains/forests. Modern builds (2016–2025) add PAC SIDs: