Constrained Delegation
Introduction
Constrained delegation is a safer means for services to perform Kerberos delegation (act on their behalf). Constrained delegation aims to restrict the services to which the server can act on behalf of the user. It no longer allows the server to cache TGTs of other users. But it does allow it to request a TGS for another user (using it's own TGT).
Enumerate hosts configured for constrained delegation
Perform Delegation
To perform the delegation, we need the TGT of the principal (computer or user) trusted for delegation. The most direct way is to extract it with Rubeus dump:
Technique: We can also request one with Rubeus asktgt if you have NTLM or AES hashes.
Dump TGT
Get TGT
With the TGT, perform an S4U request to obtain a usable TGS. We want someone who we know to be a local admin on the target. In this case, a domain admin makes the most sense.
This will perform an S4U2Self first and then an S4U2Proxy.
where:
/impersonateuseris the user we want to impersonate. MUST BE LOCAL DOMAIN ADMIN to the host./msdsspnis the service principal name that SQL-2 is allowed to delegate to./useris the principal allowed to perform the delegation that we dumped a ticket for./ticketis the TGT for/user.
Create New Login Session
Note: Make sure to always use the FQDN. Otherwise, you will see 1326 errors.
Alternate Service Name
Rubeus /altservice
Last updated