Kerberos constrained delegation abuse with S4U

Use a service account's Kerberos TGT with Rubeus S4U to request an S4U2Self service ticket to that account with a chosen user's identity, then use the forwardable ticket in S4U2Proxy to request a ticket for an SPN allowed by the account's constrained-delegation policy. These steps acquire tickets only; they do not inject a ticket or establish access to the target service.