Newly discovered Kerberos delegation abuse path

The technique combines Reflective Resource-Based Constrained Delegation (RBCD) with Kerberos User-to-User (U2U) authentication to extend an existing delegation abuse path. It targets an account trusted for Constrained Delegation without Protocol Transition that has no Service Principal Name (SPN). Previously, Reflective RBCD could produce the forwardable ticket needed for this attack when the relevant account had an SPN, while U2U-based abuse of SPN-less accounts applied only to delegation with Protocol Transition. The new method bridges that gap; it is a newly demonstrated exploitation sequence, not a newly discovered Kerberos vulnerability.

The example compromises an SPN-less user allowed to delegate to a domain controller, then uses a Machine Account Quota-created computer account and RBCD configuration to build a delegation chain. The attacker extracts the user’s TGT session key, changes the user’s password hash to that key, and uses a modified Impacket S4U2Proxy request with U2U to obtain a forwardable ticket impersonating an elevated user. That ticket can then be presented in a second S4U2Proxy request to the originally authorized service. The method requires RC4 encryption to be permitted, Machine Account Quota to be enabled (or access to an existing account with an SPN), and the SPN-less resource to allow RBCD configuration. A major cost is that changing the target user’s hash effectively destroys that account’s credentials.