Lab Walkthrough Shows Kerberos Constrained Delegation Abuse Against SQL Server
Summary
A lab walkthrough demonstrates how an attacker with credentials for a misconfigured service account can use S4U2Self and S4U2Proxy to access a SQL Server as an administrator, then extract credentials and obtain a SYSTEM shell. It also covers detection and mitigations.
Key points
- The demo uses NetExec to find a service account configured for constrained delegation with Protocol Transition.
- Impacket is used to request a service ticket impersonating an administrator for the delegated SQL Server service.
- The lab then demonstrates SQL Server access, local credential extraction, and a PsExec SYSTEM shell using the Kerberos ticket.
- Detection guidance includes monitoring delegation-related LDAP queries, Kerberos service-ticket events, remote service creation, and credential-dumping activity.
- Mitigations include preferring Kerberos-only delegation, protecting privileged accounts from delegation, auditing delegation settings, and using least-privilege or gMSA service accounts.
Article Details
- Topic
- Kerberos Constrained Delegation with Protocol Transition: lab exploitation, detection, and mitigation
MITRE ATT&CK
T1003.002 · Security Account ManagerThe walkthrough uses secretsdump to extract local SAM hashes from the SQL Server host.T1550.003 · Pass the TicketThe walkthrough uses a cached Kerberos service ticket to authenticate to SQL Server and obtain a remote SYSTEM shell.T1569.002 · Service ExecutionThe walkthrough uses PsExec to create a service and obtain an interactive SYSTEM-level shell on the remote host.
Vendors
Products
Microsoft Active Directoryof abusing Kerberos Constrained Delegation (KCD) with Protocol Transition (S4U2Self + S4U2Proxy) in Active Directory to impersonate high-privilege users and access a SQL Server.Microsoft WindowsThe attacker now has an interactive SYSTEM shell on WIN-SQL — the highest privilege level on a Windows machine.SQL ServerTransition (S4U2Self + S4U2Proxy) in Active Directory to impersonate high-privilege users and access a SQL Server.
Tools
BloodHoundAlert on large-volume LDAP queries from unexpected source IPs — tools like BloodHound and NetExec generate characteristic query patterns.ImpacketIt demonstrates exploiting a misconfigured service account (kavish) using tools like Impacket and outlines detection strategies and mitigations for defenders.NetExecAttackers can enumerate delegation settings with NetExec and exploit them with Impacket to request service tickets impersonating privileged accounts.PsExecLoaded Kerberos tickets enable actions like secretsdump and psexec, leading to credential extraction and SYSTEM-level shells on target hosts.secretsdumpLoaded Kerberos tickets enable actions like secretsdump and psexec, leading to credential extraction and SYSTEM-level shells on target hosts.ZeekThis can be detected via network-level Kerberos monitoring (e.g., Zeek with Kerberos analyzers).