Skip to content

Resource-Based Constrained Delegation abuse

Named by 2 kept items in this workspace.

Search every workspace for Resource-Based Constrained Delegation abuse. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • WriteAccountRestrictions (WAR) – What is it good for?
    writeup2025-10-01It is written here as Resource-Based Constrained Delegation (RBCD) abuse.

    Using WAR to set msDS-AllowedToActOnBehalfOfOtherIdentity and impersonate users via S4U2self/S4U2Proxy to compromise target systems

  • Kerberosity Killed the Domain: An Offensive Kerberos Overview
    article2020-03-10It is written here as Resource-Based Constrained Delegation (RBCD) abuse.

    Modifying the msDS-AllowedToActOnBehalfOfOtherIdentity property on a computer object (via GenericWrite or a newly created machine account) to allow an attacker-controlled SPN account to impersonate any user via S4U2Self/S4U2Proxy to that computer, even without a forwardable ticket

All techniques in this workspace.