Attacking Delegation
Based on our enumeration,
we know that web01 allows constrained delegation to file01.
To exploit this, we are going to need the NTLM hash for web01,
which in turn means that we’ll need to obtain higher privileges locally
on the web server.
Once we have the NTLM hash in hand,
we can use the S4U protocol transition
to request a forwardable TGS for the CIFS service
on file01 in the context of an administrative user.