Proxy's mirror image: crack a KeePass vault, then write your own delegation right onto the DC and S4U to SYSTEM.