---
id: 5963
title: "SPN-jacking: An Edge Case in WriteSPN Abuse"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/spn-jacking-an-edge-case-in-writespn-abuse/"
published_at: "2022-02-10T08:00:07Z"
tags: ["active-directory", "kerberos", "bloodhound", "attack-paths", "spn-jacking", "constrained-delegation"]
phying_url: "https://phying.com/item/5963"
lang: en
---

# SPN-jacking: An Edge Case in WriteSPN Abuse

## Summary

Elad Shamir details SPN-jacking: with WriteSPN rights over a target SPN and another service account, an attacker lacking SeEnableDelegation can temporarily hijack the SPN and run a full S4U attack—reviving dead-end paths.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2022-02-10T08:00:07Z
- **Original:** https://www.semperis.com/blog/spn-jacking-an-edge-case-in-writespn-abuse/
- **Phying News:** https://phying.com/item/5963