New Kerberos chain abuses constrained delegation on SPN-less accounts via RBCD and U2U

A newly documented Kerberos attack chain makes it possible to abuse Active Directory's Constrained Delegation without Protocol Transition against accounts that have no service principal name, a configuration that previously sat outside the reach of known delegation abuse techniques. The research was published on hunio.org and has been circulating on Hacker News, with the write-up also republished by Sprocket Security.

Two techniques, one gap

According to the post, Constrained Delegation exists in two forms. With Protocol Transition, a service can impersonate a user through S4U2Self without that user authenticating first. Without Protocol Transition, the service must already hold a forwardable ticket for the user before it can perform S4U2Proxy, which is precisely the artifact attackers have tried to fabricate.

Elad Shamir's Reflective Resource-Based Constrained Delegation technique addresses the fabrication problem. Because users and machines can by default write their own RBCD attribute, an attacker who compromises a resource can make it trust a machine account added through Machine Account Quota, then chain two S4U2Proxy operations to mint a forwardable service ticket impersonating an elevated user. The limitation is that the approach depends on SPNs.

Separately, James Forshaw showed that SPN-less accounts can still be targeted through User-to-User authentication, where the KDC encrypts tickets with a TGT session key instead of a service password. By overwriting a user's password hash with that user's own TGT session key, an attacker can generate an impersonated ticket and pivot through delegation, destroying the account's valid credentials in the process. That trick, however, only applied to Constrained Delegation with Protocol Transition.

The new chain

The hunio.org post bridges the two approaches: it runs Reflective RBCD with a U2U-based S4U2Proxy, producing the forwardable ticket needed for the no-Protocol-Transition variant from an account that has no SPN.

The walkthrough uses a compromised user, LAMB, that is allowed to delegate to a domain controller service but has no SPN. The steps are: request a TGT for LAMB and extract its session key; add a helper machine account via Machine Account Quota; configure RBCD so LAMB trusts the new machine; overwrite LAMB's password hash with the TGT session key, sacrificing the account; perform an S4U2Proxy with U2U to obtain a forwardable ticket impersonating Administrator; and finally pass that evidence ticket through a second S4U2Proxy against the real target service. The demonstration ends with credential extraction from the domain controller.

Extending Impacket

The novel piece was tooling rather than protocol behavior. Impacket did not support performing S4U2Proxy with U2U, so the author modified getST.py in four ways: setting the resource_based_constrained_delegation flag in PA-PAC-OPTIONS, without which the KDC returns KDC_ERR_BADOPTION; setting enc-tkt-in-skey in kdc-options so the KDC encrypts its response ticket with a TGT session key; setting the sname name-type to kRB5-NT-UNKNOWN and pointing it at the target user; and supplying two tickets instead of one, the target's TGT alongside the S4U2Self evidence ticket, so the KDC can extract the session key.

Prerequisites and trade-offs

The chain carries the same requirements as the techniques it builds on. The domain must permit RC4 encryption, Machine Account Quota must be enabled, and the SPN-less resource must be able to configure RBCD on itself, which is the default. If MAQ is disabled, the attacker instead needs prior control of something that already has an SPN. The attack also destroys the delegation-trusted account, since its original credentials stop being valid once the hash is replaced.

The author is explicit that this is not a new vulnerability in Kerberos. It is a new sequence of steps for exploiting a delegation configuration that, as far as the research shows, had never been abused this way before.

Why it matters

Accounts trusted for Constrained Delegation without Protocol Transition were, in practice, protected by a methodology gap rather than by the protocol itself, and that gap is now closed. For defenders, the prerequisites double as a mitigation checklist: disabling RC4, setting Machine Account Quota to zero, and restricting or monitoring writes to the RBCD attribute each break the chain at a different link. Detection teams should also expect S4U2Proxy-with-U2U behavior to appear in offensive tooling now that the required Impacket changes are documented, which makes auditing delegation-trusted accounts, especially SPN-less ones, a higher priority than it was last week.