domains / families / security / exploiting-constrained-delegation-abuse

exploiting-constrained-delegation-abuse

separate

Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to abuse S4U2Self and S4U2Proxy and impersonate privileged users. Use during authorized Active Directory penetration tests or red-team engagements for lateral movement and privilege escalation after finding an account trusted for constrained delegation.

When to use

• When performing authorized security testing that involves exploiting constrained delegation abuse
• When analyzing malware samples or attack artifacts in a controlled environment
• When conducting red team exercises or penetration testing engagements
• When building detection capabilities based on offensive technique understanding

When not to use

• Unauthorized use against systems you do not own or have written permission to test

Skill page

Source