• Constrained Delegation when enabled on a service account, allows access only to specified services on specified computers as a user.
• A typical scenario where constrained delegation is used - A user authenticates to a web service without using Kerberos and the web service makes requests to a database server to fetch results based on the user's authorization.
• To impersonate the user, Service for User (S4U) extension is used which provides two extensions:
  • Service for User to Self (S4U2self) - Allows a service to obtain a forwardable TGS to itself on behalf of a user.
  • Service for User to Proxy (S4U2proxy) - Allows a service to obtain a TGS to a second service on behalf of a user
• To impersonate the user, Service for User (S4U) extension is used which provides two extensions:
  • Service for User to Self (S4U2self) - Allows a service to obtain a forwardable TGS to itself on behalf of a user with just the user principal name without supplying a password. The service account must have the TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION – T2A4D UserAccountControl attribute.
  • Service for User to Proxy (S4U2proxy) - Allows a service to obtain a TGS to a second service on behalf of a user. Which second service? This is controlled by msDS-AllowedToDelegateTo attribute. This attribute contains a list of SPNs to which the user tokens can be forwarded.

1. A user - Joe, authenticates to the web service (running with service account websvc) using a non-Kerberos compatible authentication mechanism.
2. The web service requests a ticket from the Key Distribution Center (KDC) for Joe's account without supplying a password, as the websvc account.
3. The KDC checks the websvc userAccountControl value for the TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION attribute, and that Joe's account is not blocked for delegation. If OK it returns a forwardable ticket for Joe's account (S4U2Self).
4. The service then passes this ticket back to the KDC and requests a service ticket for the CIFS/dcorpmssql.dollarcorp.moneycorp.local service.
5. The KDC checks the msDS-AllowedToDelegate To field on the websvc account. If the service is listed it will return a service ticket for dcorp-mssql (S4U2Proxy).
6. The web service can now authenticate to the CIFS on dcorpmssql as Joe using the supplied TGS.

• To abuse constrained delegation in above scenario, we need to have access to the websvc account. If we have access to that account, it is possible to access the services listed in msDS-AllowedToDelegateTo of the websvc account as ANY user

• Enumerate users and computers with constrained delegation enabled

Get-DomainUser –TrustedToAuth

Get-DomainComputer –TrustedToAuth

• Either plaintext password or NTLM hash/AES keys is required. We already have access to websvc's hash from dcorp-adminsrv

• Using asktgt from Kekeo, we request a TGT (steps 2 & 3 in the diagram):