Abusing Constrained Delegation without Protocol Transition against SPN-less accounts
Summary
The article introduces a new Kerberos delegation abuse path that combines Reflective Resource-Based Constrained Delegation with U2U and Impacket enhancements to perform S4U2Proxy without Protocol Transition against SPN-less accounts. It details prerequisites, step-by-step techniques, and example commands, highlighting potential impact and mitigations for domain configurations.