1 comments
I've recently released a blog covering how I discovered a new Kerberos delegation abuse path!<p>By combining Elad Shamir's Reflective RBCD with James Forshaw's U2U sacrificial user technique, Constrained Delegation without Protocol Transition can now be abused against SPN-less accounts. I also had to add S4U2Proxy + U2U support to Impacket to get this working. :)<p>Blog: <a href="https://hunio.org/security/abusing-constrained-delegation-without-protocol-transition-against-spn-less-accounts" rel="nofollow">https://hunio.org/security/abusing-constrained-delegation-wi...</a><p>Impacket PR: <a href="https://github.com/fortra/impacket/pull/2324" rel="nofollow">https://github.com/fortra/impacket/pull/2324</a>