Researchers chain Reflective RBCD and U2U to hijack Kerberos delegation on SPN-less accounts
Newly discovered Kerberos delegation abuse path
A new attack path closes a gap in Kerberos delegation research: abusing Constrained Delegation without Protocol Transition against accounts that have no SPN. By combining Elad Shamir's Reflective RBCD with James Forshaw's U2U sacrificial-user trick and extending Impacket to support S4U2Proxy with U2U, an attacker can forge the forwardable ticket that delegation demands. It requires RC4 permitted, MAQ enabled, and destroys the targeted account.
This is not a new vulnerability in Kerberos, but rather a new set of steps to successfully exploit a configuration that has seemingly never been done before.