Pull to refresh
Logo
What Changed
Following Why Sign Up
New Kerberos attack abuses constrained delegation on SPN-less accounts

New Kerberos attack abuses constrained delegation on SPN-less accounts

New Capabilities

Sprocket Security chains two known techniques to forge forwardable tickets against accounts once considered safe

October 30th, 2026: Impacket PR author adds flag checks

Overview

Updated Nov 1

A new Kerberos attack can take an attacker from one compromised account to full control of a domain, even when the target account has no service principal name (SPN, the identifier Kerberos uses for services). Sprocket Security's Hunter Wade published the technique in October 2026, combining two known methods: reflective resource-based constrained delegation and user-to-user authentication. In the proof of concept, the chain reached domain administrator and extracted credentials from a domain controller.

The attack still needs RC4 encryption enabled and an open machine account quota, and it destroys the account it uses. The Impacket toolkit pull request that adds the needed support is under review. Maintainers requested changes on October 28, and the author added the requested checks by October 30.

Why it matters

If domains keep RC4 encryption enabled and machine account quotas open, this hands attackers a new route to domain admin from any compromised account.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

4
Code changes to Impacket getST.py
Four modifications enable S4U2Proxy with U2U against SPN-less accounts.
7
Steps in the attack chain
From initial ticket request to full domain compromise in the proof of concept.
2
Review rounds on Impacket PR #2324
Maintainers requested changes on October 28, and the author responded the same day.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

S(
Sprocket Security researcher (elohhs)
Penetration tester, Sprocket Security
Published the technique and opened the Impacket pull request as 1hunio
 Elad Shamir
Elad Shamir
Security researcher
Prior research forms half of the new attack
JF
James Forshaw
Security researcher, Google Project Zero
Developed the U2U sacrificial user technique
TI
Tudor Iancu
Security researcher, ESSGroup
Published independent analysis of the disclosure

Organizations Involved

Sprocket Security
Sprocket Security
Penetration testing firm
Disclosed the Kerberos delegation attack

Firm whose researcher discovered and publicly disclosed the constrained delegation abuse path.
IM
Impacket (fortra)
Open-source security tooling project
Reviewing PR #2324 adding U2U support; maintainers requested changes on October 28, 2026, and the author added the checks by October 30

Python toolkit for Kerberos and Active Directory attacks; maintainers hold the pull request enabling the new technique.

Timeline

September 2026 October 2026

6 events Latest: October 30th, 2026 · 1 week ago
Tap a bar to jump to that date

  1. Impacket PR author adds flag checks

    Latest Development

    The PR author, 1hunio, said the checks were added so -nospn requires -impersonate and -additional-ticket is rejected with -nospn.

  2. Technique surfaces on Hacker News

    Publication

    Hacker News post shares the September disclosure with a wider security audience.

  3. Impacket reviewer requests changes to PR #2324

    Development

    Reviewer alexisbalbachan asked the author to reject invalid -nospn flag combinations and to reject -additional-ticket when -nospn is used.

  4. Blog reveals Kerberos delegation attack

    Disclosure

    Sprocket Security's crosspost of the technique, written by Hunter Wade, combines reflective RBCD with U2U against SPN-less accounts.

  5. Sprocket Security disclosure recognized

    Disclosure

    The constrained delegation abuse path is publicly disclosed by Sprocket Security, per ESSGroup analysis.

  6. Impacket pull request adds U2U support

    Development

    PR #2324 submitted to fortra/impacket adding S4U2Proxy+U2U support needed for the technique.

Scenarios

1

Impacket merges U2U support for the new attack

Likely Resolves by Q1 2027

Discussed by: Fortra Impacket maintainers and the offensive security tooling community

Pull request 2324, adding S4U2Proxy+U2U support to getST.py, clears review and merges into the main branch. That makes the technique a one-command operation in the standard toolkit, lowering the barrier for red teams and attackers alike.

2

Microsoft publishes hardening guidance for SPN-less delegation abuse

Possible Resolves by Q2 2027

Discussed by: Enterprise Active Directory administrators and Microsoft security teams

Microsoft's security response team issues an advisory or documentation update covering constrained delegation abuse in SPN-less accounts. Likely recommendations mirror published guidance: disable RC4, restrict machine account quota, and monitor the msDS-AllowedToActOnBehalfOfOtherIdentity attribute.

3

First real-world exploitation of the delegation technique reported

Possible Resolves by Q2 2027

Discussed by: Incident response firms tracking Kerberos-based intrusions

A public case report from a major incident response firm documents an intrusion using this technique to reach domain admin. This would confirm that the attack has moved from research into criminal tooling.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2021

Wagging the Dog (2021)

Security researcher Elad Shamir published 'Wagging the Dog,' showing how attackers could abuse resource-based constrained delegation when they control a computer with an SPN. He demonstrated chaining S4U2Self and S4U2Proxy to obtain forwardable tickets for any user.

Then

RBCD abuse became a standard Active Directory attack, with tools like Impacket adding automated modules.

Now

It established reflective RBCD, the first half of the new technique targeting SPN-less accounts.

Why this matters now

The new attack adapts Shamir's reflective RBCD chain to work without any SPN.

2014

Kerberoasting (2014)

At the DerbyCon security conference, researcher Tim Medin showed that any domain user could request Kerberos service tickets and crack service account passwords offline. The requests never trigger account lockout.

Then

Kerberoasting became a headline Active Directory attack, pushing defenders toward long random service account passwords and AES-only encryption.

Now

It established the pattern of abusing legitimate Kerberos features against operational assumptions, which the new delegation attack follows.

Why this matters now

Both attacks use Kerberos's own functions to defeat assumptions about which domain accounts are safe.

2020s

U2U sacrificial user technique (2020s)

Google Project Zero researcher James Forshaw developed a method pairing user-to-user authentication with Kerberos delegation to obtain forwardable tickets. The approach uses a sacrificial account whose session key serves as the ticket encryption key.

Then

The technique fed into Impacket and further research on delegation abuse paths.

Now

It supplied the second half of the new attack: user-to-user authentication against an SPN-less account.

Why this matters now

The new technique is the direct combination of Shamir's reflective RBCD and Forshaw's U2U method.

Sources

(10)
+4
hun.io ESSGroup GitHub (fortra/impacket) Infosec Exchange Raymond Tec (OTX) Semperis The Hacker Recipes Sprocket Security webkkk.net (mirror of fortra/impacket) hun.io