Kerberos delegation

First of all, we need to discuss what delegation is and why it exists. Services within Active Directory sometimes need to be accessed by other services on behalf of the domain user. Think of a web server authenticating to the database on the backend on behalf of the user. There are three types of delegation available in Active Directory (AD) – unconstrained, constrained, and resource-based. Information about delegation can be found by using BloodHound, PowerView, or the AD module. We will cover the types of delegation in the following respective sections.

Note

For our lab, Mayfly prepared, as usual, a great walk-through to follow: https://mayfly277.github.io/posts/GOADv2-pwning-part10/.

Unconstrained delegation

We will start our journey with the oldest type of delegation. With unconstrained delegation enabled on the computer or user, it is possible to impersonate an authenticating user or computer to any service on any host. If we compromise the...