A new Kerberos delegation abuse path: combine Reflective RBCD, U2U, and an Impacket S4U2Proxy extension to exploit constrained delegation without an SPN.
Resources
Blog
Hunter Wade
Blogs by Hunter Wade
Apex, one of Sprocket's AI agents, found a session injection flaw in minutes. Human testers chained it into two zero-days.
How ASRepCatcher uses ARP poisoning to obtain crackable AS-REP hashes from any authenticating user, even when Kerberos preauthentication is enabled.
Step-by-step walkthrough of cracking NTLMv1-SSP hashes with rainbow tables, including how to coerce auth, disable ESS, recover NT hashes, and remediate.
