Kerberos Bronze Bit (CVE-2020-17049)

Abuses CVE-2020-17049 on a Domain Controller that is not enforcing the Kerberos S4U ticket-signature fix. With an internal foothold and the key of a service account allowed to delegate to a target SPN through constrained or resource-based constrained delegation, the operator uses S4U2Self, flips the intermediate ticket's forwardable flag with the service-account key, and completes S4U2Proxy to obtain a service ticket for a protected or non-delegable user. The resulting ticket authenticates that user to the delegated target service; it does not by itself grant local or domain administrator privileges.