DavRelayUp

DavRelayUp is a Windows tool that can relay a domain-joined workstation's coerced machine-account NTLM authentication from WebDAV to LDAP, configure resource-based constrained delegation (RBCD) for a controlled computer account, obtain a Kerberos service ticket to the workstation, and create a service through SCM to run as LocalSystem. It requires a viable WebClient/WebDAV coercion path, an attacker-controlled or creatable computer account, an impersonated account with local administrator rights on the workstation, and a domain controller that accepts the relayed LDAP bind. LDAP signing and other protections can prevent the chain; this is configuration-dependent, not a universal no-fix exploit.