Impacket-findDelegation

Impacket findDelegation.py enumerates every delegation relationship in the domain over LDAP: unconstrained, constrained (S4U2Proxy allowed-to-delegate-to targets) and resource-based constrained delegation. The output identifies accounts and computers that can be abused for privilege escalation and lateral movement via Kerberos delegation. Requires any valid domain credentials. Command Reference: Domain: test.local Username: john Password: password123 DC IP: 10.10.10.1

# Enumerate all delegation relationships in the domain
findDelegation.py test.local/john:password123 -dc-ip 10.10.10.1

Native

Enumeration, Discovery

Requires

Username, Password

Services

Kerberos, LDAP

Refs

github.com/fortra/impacket

www.thehacker.recipes/ad/movement/kerberos/delegations

book.hacktricks.xyz/windows-hardening/active-directory-methodology/constrained-delegation