freeipa

Servidor FreeIPA FreeIPA permite a los administradores de Linux gestionar de forma centralizada los aspectos de identidad, autenticación y control de acceso de los sistemas Linux y UNIX, ofreciendo herramientas de gestión por línea de comandos y web, fáciles de instalar y usar. FreeIPA está...

noPac

noPac このプロジェクトは、noPac の原理学習のために生まれました。cube0x0 のプロジェクトをベースにいくつかの変更を加えています。ソースコードには個人的な理解のコメントを追加しました。 Scan 機能を削除しました。個人的には Scan 機能はあまり役に立たないと感じました。 MachineAccountQuota 値の判定を追加しました。0 の場合はプログラムを終了します。 コンピュータアカウント追加時の判定処理を最適化しました。 TGT の出力を追加しました。 脆弱性の分析記事は私のブログ記事をご覧ください：noPac 分析 利用条件 noPac は...

kerbrute

Kerbrute Kerberos 事前認証を利用して、有効な Active Directory アカウントを高速にブルートフォースおよび列挙するためのツール 最新のバイナリは リリースページ から入手して始めてください。 背景 このツールは、数年前に Heimdal Kerberos クライアントを Linux から使ってブルートフォースを行うために作成した bash スクリプト から発展しました。Kerberos クライアントをインストールする権限を必要としないものを作りたいと考えていたところ、純粋な Go 実装の Kerberos ライブラリ gokrb5 に出会い、ついに Go...

orpheus

Orpheus Orpheus 是一个包装器，封装了 Impacket 的 GetUserSPNs.py 和 kerberosv5.py 的修改版本，用于更改 Kerberoasting 的 KDC 选项（票据选项）和加密类型。 旁注：Orpheus 以希腊神话中的神明命名，他能够绕过刻耳柏洛斯（三头犬）进入冥界。 安装 / 运行 你需要安装最新版本的 Impacket。该项目已在 0.10.0 版本 上测试。然后 git clone https://github.com/trustedsec/orpheus.git cd orpheus python3 orpheus.py 命令 输入...

cve-2025-53779-kerberos_bypass_reproduction

CVE-2025-53779：Microsoft Windows Kerberos 身份验证绕过 CVSS 评分： 9.8（严重） 状态： 已发现在野积极利用 披露： 微软 2025 年 8 月补丁星期二（零日漏洞） 概述 CVE-2025-53779 是 Microsoft Windows Kerberos 协议实现中的一个严重身份验证绕过漏洞。未经身份验证的攻击者可利用该缺陷完全绕过 Kerberos 身份验证，冒充包括域管理员在内的任何域用户，而无需持有有效凭据或任何加密材料。 微软将该漏洞评为 CVSS...

cve-2026-20833-rc4-kerberos

CVE-2026-20833 — Kerberos RC4 加固 本仓库整合了与 Active Directory 环境中 Kerberos 逐步弃用 RC4 相关的技术文档 、PowerShell 脚本 、Power BI 仪表板 以及微软官方参考资料 ，作为微软针对 CVE-2026-20833 的安全变更的一部分。 其目标是支持各组织完成以下工作： 安全审计 检测 RC4 的使用情况 修复规划 为 2026 年 Kerberos RC4 强制执行阶段做好运维准备 !NOTE 本仓库中的材料旨在帮助各组织识别遗留的 Kerberos 依赖项 ，并在微软强制执行阶段开始之前做好环境准备...

CLEANSTART-2024-BR37030 ec_verify in kdc/kdc_preauth_ec

Security vulnerability affects the krb5 package. ecverify in kdc/kdcpreauthec...

Rocky Linux 9 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / krb5-libs / etc Multiple Vulnerabilities (crlsa-2023_6699)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236699 advisory. krb5: Denial of service through freeing uninitialized pointer CVE-2023-36054 krb5: double-free in KDC TGS processing CVE-2023-39975 Tenable has extracted t...

Rocky Linux 8 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / etc Multiple Vulnerabilities (crlsa-2021_3576)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213576 advisory. krb5: Sending a request containing PA-ENCRYPTED-CHALLENGE padata element without using FAST could result in NULL dereference in KDC which leads to DoS...

AlmaLinux 9.2 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc (ALMALINUX9.2:CLSA-2024:1718787475)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1718787475 advisory. - kdc/dotgsreq.c in MIT Kerberos 5 aka krb5 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an...

CVE-2026-95503

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center KDC by requesting a server ticket. This...

CVE-2026-95503 Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center KDC by requesting a server ticket. This...

EUVD-2026-84288

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center KDC by requesting a server ticket. This...

CVE-2026-95503 Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center KDC by requesting a server ticket. This...

CVE-2026-95503

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center KDC by requesting a server ticket. This...

CVE-2026-95503

Keycloak's Kerberos federation provider contains a KDC spoofing bypass that occurs when Kerberos password authentication is enabled without SPNEGO. In this configuration, Keycloak fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket, allowing an attacker...

PT-2026-96681

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Kerberos federation provider of Keycloak. When Kerberos password authentication is utilized without SPNEGO Simple Protocol for Negotiating Access to a Server, the system...

CVE-2026-95503: Improper Verification of Cryptographic Signature

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center KDC by requesting a server ticket. This...

The vulnerability of the Kerberos Key Distribution Center (KDC) component of Windows operating systems allows a perpetrator to trigger a service failure.

The vulnerability of the Kerberos Key Distribution Center KDC component in Windows operating systems is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: samba (UTSA-2026-100778)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100778 advisory. An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded...