Attacking Kerberos Delegation

Delegation lets a service impersonate users to other services. Every form of it is a controlled way to become someone else, and each has a misconfiguration that removes the control. RBCD in particular turns a common, low-looking permission — write access to a computer object — into full compromise of that host, which is why it is the delegation attack that comes up most.

Only against domains you are authorized to test.

When to Use

• BloodHound flags Unconstrained, Constrained, or RBCD delegation
• You control an account with an SPN, or GenericWrite/GenericAll over a computer object
• You can create machine accounts (default MachineAccountQuota is 10)
• You control a host configured for delegation
• Reviewing delegation configuration defensively