Abusing Delegation with Impacket (Part 1): Unconstrained Delegation

### Executive Summary This blog post details how attackers can abuse Kerberos unconstrained delegation in Active Directory environments to escalate privileges and obtain domain credentials. It explains Kerberos concepts and the double‑hop problem, then provides hands‑on procedures—adding SPNs or modifying DNS records, running a Kerberos relay listener (krbrelayx), coercing a Domain Controller to authenticate to the attacker, exporting the obtained TGT, and performing DCSync—along with cleanup steps and caveats.