Delegation Abuse Commands

9 Delegation Abuse commands from the Privilege Escalation category, each with its placeholders, supported authentication methods and upstream references.

Tools covered: Rubeus.exe, bloodyAD, impacket-addcomputer, impacket-getST, impacket-rbcd, nxc, python3

• bloodyAD add badSuccessor Create a Delegated Managed Service Account (dMSA) and chain it via msDS-ManagedAccountPrecededByLink to a…
• bloodyAD Set RBCD Configure Resource-Based Constrained Delegation: write msDS-AllowedToActOnBehalfOfOtherIdentity on a target…
• Impacket Add Computer Create a new computer account in Active Directory (used for RBCD attacks)
• Impacket getST (S4U) Abuse constrained delegation or RBCD via S4U2Self/S4U2Proxy to impersonate a user
• Impacket RBCD Write Write msDS-AllowedToActOnBehalfOfOtherIdentity to configure RBCD on a target
• NetExec badsuccessor Module (dMSA Abuse) Detect BadSuccessor dMSA-link abuse: a Server 2025 delegated Managed Service Account whose…
• PyWhisker Shadow Credentials Add shadow credentials to a target account's msDS-KeyCredentialLink attribute
• RBCD Attack Configure Resource-Based Constrained Delegation (RBCD) on a target computer
• Rubeus S4U Delegation Abuse constrained delegation via S4U on Windows using Rubeus