Impacket findDelegation.py

Back to the Category Index / Back to the Command Index

Overview

Searches LDAP and lists unconstrained delegation, constrained delegation, and RBCD settings in a domain.

Item	Details
Implementation	examples/findDelegation.py
Category	Active Directory / LDAP / Account Management
Size	283 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/findDelegation.py -h for the current option definitions.

Argument	Description
target	domain[/username[:password]]
-target-domain	Domain to query if different from the user’s domain; supports delegation queries across trusts.
-ts	Add timestamps to log output.
-debug	Enable debug logging.
-user	Request data for a specific user.
-disabled	Include disabled users in the query.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.
-dc-ip	Domain controller IP address. Defaults to the domain (FQDN) in the target; ignored if -target-domain is set.
-dc-host	Domain controller hostname. Defaults to the domain (FQDN) in the account parameter.
-ldaps / -use-ldaps	Use LDAPS instead of LDAP.

Detailed Processing Flow

The command binds to the target domain and searches user and computer UAC values, msDS-AllowedToDelegateTo, and RBCD security descriptors. It resolves SIDs and SPNs, then tabulates account type, delegation type, and target SPNs.

How It Works

Delegation is not represented by a single attribute. The command combines an account’s userAccountControl, msDS-AllowedToDelegateTo, and msDS-AllowedToActOnBehalfOfOtherIdentity to classify unconstrained, constrained, constrained with protocol transition, and RBCD delegation. It transforms these attributes into relationships describing who can delegate to which service or account, rather than merely listing SPNs.

Ordinary constrained delegation stores the target SPNs on the delegating account. RBCD reverses this: permitted SIDs are stored in the security descriptor on the destination computer. run() parses the binary RBCD descriptor with ldaptypes and resolves each ACE’s SID to a directory object name. Normalizing these directions into one table is central to the implementation.

Failure to resolve a SID or SPN does not prove the relationship is absent. A deleted object, a SID from another domain, or insufficient read permissions may leave only a raw SID. When changing checkIfSPNExists() or name resolution, retain the underlying delegation record even if display-name enrichment fails.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
FindDelegation	58	__init__(), printTable(), run()
checkIfSPNExists()	36	Module function

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.dcerpc.v5.samr	UF_ACCOUNTDISABLE, UF_TRUSTED_FOR_DELEGATION, UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION
impacket.examples	logger
impacket.examples.utils	ldap_login, parse_identity
impacket.ldap	ldap, ldapasn1, ldaptypes

Output, Side Effects, and Required Privileges

• Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on ldap / ldapasn1 / ldaptypes, SAMR delegation flags, and ldap_login. checkIfSPNExists() and FindDelegation.run() handle search and classification. With cross-domain -target-domain, preserve the distinction between the authentication domain and search base.

Verification

• Syntax: python -m py_compile examples/findDelegation.py
• CLI: python examples/findDelegation.py -h
• Related test: tests/SMB_RPC/test_ldap.py
• Related test: tests/dcerpc/test_samr.py