New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts
Source Reddit NetSec
Discussion
A new Kerberos abuse technique has been discovered that allows constrained delegation without protocol transition to be exploited against SPN-less accounts. This method combines previous research techniques to expand the attack surface of Kerberos delegation abuse. The researcher updated Impacket to support this new abuse path, facilitating practical exploitation. No specific affected software versions or patches are identified. The threat is considered medium severity based on the described impact.
r/netsec (opens in a new tab)u/elohhs0 points0 comments
I've recently released a blog covering how I discovered a new Kerberos delegation abuse path!
By combining Elad Shamir's Reflective RBCD with James Forshaw's U2U sacrificial user technique, Constrained Delegation without Protocol Transition can now be abused against SPN-less accounts. I also had to add S4U2Proxy + U2U support to Impacket to get this working. :)
Impacket PR: https://github.com/fortra/impacket/pull/2324