SPN hijack — redirect constrained delegation to the DC

Abuse a delegated service account's Kerberos constrained-delegation configuration (including protocol transition for Impacket's S4U2Self/-impersonate path) after obtaining effective write access to the servicePrincipalName attribute on the object being changed. Move an allow-listed SPN from its current owner to a domain-controller computer account; the KDC's S4U2Proxy service ticket is then encrypted with the DC account's key. Impacket -altservice changes the service name stored in the resulting ticket/cache and may permit use with a compatible DC service, subject to SPN mappings, service behavior, replication, and the impersonated principal's rights. This produces a delegated service ticket; the redirection alone does not establish domain-wide control.