I've recently released a blog covering how I discovered a new Kerberos delegation abuse path!
By combining Elad Shamir's Reflective RBCD with James Forshaw's U2U sacrificial user technique, Constrained Delegation without Protocol Transition can now be abused against SPN-less accounts. I also had to add S4U2Proxy + U2U support to Impacket to get this working. :)
By combining Elad Shamir's Reflective RBCD with James Forshaw's U2U sacrificial user technique, Constrained Delegation without Protocol Transition can now be abused against SPN-less accounts. I also had to add S4U2Proxy + U2U support to Impacket to get this working. :)
Blog: https://hunio.org/security/abusing-constrained-delegation-wi...
Impacket PR: https://github.com/fortra/impacket/pull/2324