Abuse unconstrained delegation with a coerced DC

A host with unconstrained delegation caches TGTs of everyone who authenticates; coerce a DC to it and steal the DC TGT.