Active Directory

Abusing Constrained Delegation without Protocol Transition against SPN-less accounts

A security write-up from hunio.org introducing a new Kerberos delegation abuse path in Active Directory: by combining Elad Shamir's Reflective RBCD technique, James Forshaw's U2U sacrificial-user technique and an Impacket extension, constrained delegation without protocol transition can be abused even when only SPN-less user accounts are available, with step-by-step commands and references.

Research · Cybersecurity · Active Directory · Kerberos