Definition
Delegation lets a service act on behalf of a user toward another service. In its unconstrained form, the service receives reusable authentication material for every user that authenticates to it, with no restriction on where that material may then be used.
Why it inverts the usual risk model
Security effort concentrates on protecting high-value systems. Unconstrained delegation makes an ordinary host valuable in a different way: not for the data it holds, but for the credentials that pass through it. Compromising it yields material for whoever connected, potentially including administrators.
What to review
- Which accounts and hosts are trusted for delegation
- Whether constrained delegation would serve the same purpose
- Which privileged identities authenticate to those hosts
- Whether sensitive accounts are protected from delegation
- Compromised Host
- Delegated Authentication
- Privileged Credential
- Domain Resource
Each hop validated by successful exploitation
Tags
- kerberos
- delegation
- credentials