Kerberos Unconstrained Delegation
O que é Kerberos Unconstrained Delegation?
Kerberos Unconstrained DelegationAn Active Directory configuration that lets a service receive and store TGTs for any authenticating user, allowing it to impersonate them to any other service — a high-impact misconfiguration repeatedly abused for credential theft and domain compromise.
Unconstrained delegation is the original Kerberos delegation mode in Active Directory. A computer or service account marked 'Trust this computer for delegation to any service' (the TRUSTED_FOR_DELEGATION user-account-control flag) receives the user's TGT inside the Kerberos service ticket as part of the standard double-hop sign-in. The service can then use that TGT to request service tickets for the user to any other service in the forest — there is no scoping. Attackers love this for two reasons. First, any user (including high-privilege accounts and even Domain Admins) who interacts with a compromised unconstrained-delegation host effectively donates their TGT to the attacker. Second, the 'Print Spooler bug' (and similar coerced-auth tricks like PetitPotam) can force domain controllers to authenticate to such a host, yielding the DC's TGT. Mitigations are categorical: never enable unconstrained delegation on new servers, migrate existing usage to constrained or resource-based constrained delegation, mark sensitive accounts as 'Account is sensitive and cannot be delegated', deploy Protected Users group membership for high-privilege users, and audit `userAccountControl` for the `TRUSTED_FOR_DELEGATION` flag.
● Exemplos
- 01
A red-team coerces a Domain Controller to authenticate to a compromised IIS server with unconstrained delegation, harvests the DC's TGT, and proceeds to a DCSync attack.
- 02
A blue-team sweep removes the TRUSTED_FOR_DELEGATION flag from all member servers and migrates a small set of legacy SQL servers to resource-based constrained delegation.
● Perguntas frequentes
O que é Kerberos Unconstrained Delegation?
An Active Directory configuration that lets a service receive and store TGTs for any authenticating user, allowing it to impersonate them to any other service — a high-impact misconfiguration repeatedly abused for credential theft and domain compromise. Pertence à categoria Identidade e acesso da cibersegurança.
O que significa Kerberos Unconstrained Delegation?
An Active Directory configuration that lets a service receive and store TGTs for any authenticating user, allowing it to impersonate them to any other service — a high-impact misconfiguration repeatedly abused for credential theft and domain compromise.
Como funciona Kerberos Unconstrained Delegation?
Unconstrained delegation is the original Kerberos delegation mode in Active Directory. A computer or service account marked 'Trust this computer for delegation to any service' (the TRUSTED_FOR_DELEGATION user-account-control flag) receives the user's TGT inside the Kerberos service ticket as part of the standard double-hop sign-in. The service can then use that TGT to request service tickets for the user to any other service in the forest — there is no scoping. Attackers love this for two reasons. First, any user (including high-privilege accounts and even Domain Admins) who interacts with a compromised unconstrained-delegation host effectively donates their TGT to the attacker. Second, the 'Print Spooler bug' (and similar coerced-auth tricks like PetitPotam) can force domain controllers to authenticate to such a host, yielding the DC's TGT. Mitigations are categorical: never enable unconstrained delegation on new servers, migrate existing usage to constrained or resource-based constrained delegation, mark sensitive accounts as 'Account is sensitive and cannot be delegated', deploy Protected Users group membership for high-privilege users, and audit `userAccountControl` for the `TRUSTED_FOR_DELEGATION` flag.
Como se defender contra Kerberos Unconstrained Delegation?
As defesas contra Kerberos Unconstrained Delegation costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para Kerberos Unconstrained Delegation?
Nomes alternativos comuns: UD, Trust for delegation to any service.
● Termos relacionados
- identity-access№ 652
Kerberos
Protocolo de autenticação de rede baseado em tickets que utiliza criptografia simétrica e um Centro de Distribuição de Chaves confiável para oferecer SSO seguro entre serviços.
- identity-access№ 014
Active Directory
Serviço de diretório empresarial da Microsoft para redes Windows, que fornece autenticação, autorização e gestão de políticas centralizada para utilizadores, computadores e recursos.
- identity-access№ 653
Kerberos Constrained Delegation
An Active Directory delegation mode that allows a service to impersonate users only to a specified set of target services — safer than unconstrained delegation, but still abused via S4U2Self / S4U2Proxy attacks when misconfigured.
- attacks№ 651
Kerberoasting
Ataque offline de palavras-passe que solicita tickets de servico Kerberos para contas de servico e quebra a parte cifrada para recuperar as palavras-passe em claro.
- attacks№ 886
Pass-the-Ticket
Ataque ao Active Directory que reutiliza um ticket Kerberos roubado para se fazer passar por um utilizador ou servico sem conhecer a palavra-passe.
- attacks№ 836
Ataque de NTLM Relay
Ataque adversary-in-the-middle (MITRE T1557.001) em que o atacante encaminha a autenticacao NTLM de uma vitima a outro servico para se passar por ela sem saber a senha.