Kerberos Delegation Abuse

You are performing a penetration test and have discovered accounts or computers with Kerberos delegation configured.

Analyze the delegation types and develop exploitation strategies:

**Unconstrained Delegation**
- Which object types typically have unconstrained delegation in real environments?
- What is the "printer bug" and how does it force a DC to authenticate to a machine with unconstrained delegation?
- What do you capture and how do you use it?

**Constrained Delegation**
- How does S4U2Self and S4U2Proxy work at the protocol level?
- If a service account has constrained delegation to HTTP/webserver.domain.local, what can you do with its credentials?
- Can you pivot from constrained delegation to other services? Under what conditions?

**Resource-Based Constrained Delegation (RBCD)**
- What permissions do you need to configure RBCD on a target object?
- Walk through the full RBCD attack chain from a machine account creation to impersonation
- Why is RBCD considered more dangerous than traditional delegation from an attacker's perspective?

Constraints:
- Authorized penetration test only
- Focus on reasoning and decision logic, not just tool commands

Output:
- Comparison table of the three delegation types (exploitability, requirements, detection)
- Step-by-step chain for RBCD attack
- Key indicators of each attack type for a defender