rbcd-attack

Kerberos 리소스 기반 제한 위임 남용 TL;DR 이 저장소는 Windows Active Directory 도메인에서 Kerberos 리소스 기반 제한 위임Resource-Based Constrained Delegation에 대한 실제 공격에 관한 것입니다. 다른 일반적인 구현과의 차이점은 Windows 도메인 외부에서 공격을 시작한다는 점입니다. 즉, 도메인에 가입된 보통 Windows 컴퓨터가 아닌 곳에서 공격합니다. 이 공격은 Python3Impacket만 사용하여 그리고 그 의존성 구현되었습니다. 최신...

bifrost

Bifrost \ /' | | | , | '| || , '/'\ /',| | | | || | | | , | | /' /'/ root@kitploit: Usage: ./bifrost -action dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove For dump action: -source tickets | keytab for keytab, optional -path to specify a keytab for tickets, optional -name...

S4UTomato

S4UTomato Kerberos를 통해 서비스 계정을 LocalSystem으로 승격. 전통적인 포테이토 Potatoes "Potato" 권한 상승 시리즈에 익숙한 분들은 서비스 계정 권한을 로컬 시스템 권한으로 상승시킬 수 있다는 것을 알고 있을 것입니다. 초기 "Potato"의 공격 기법은 거의 동일합니다: COM 인터페이스의 특정 기능을 활용하여 NT AUTHORITY\SYSTEM 계정을 속여 공격자가 제어하는 RPC 서버에 연결 및 인증하게 하는 것입니다. 그런 다음 일련의 API 호출을 통해 이 인증 과정에서...

EUVD-2019-5985

Malware in sbrugna...

Astra Linux – Vulnerability in freeipa

A vulnerability was discovered in FreeIPA regarding the initial implementation of MS-SFU by MIT Kerberos. This implementation lacked a condition for granting the “forwardable” flag on S4U2Self tickets. Fixing this issue required adding a special case for the checkallowedtodelegate function: If th...

CVE-2020-17049

It was found that the Kerberos Key Distribution Center KDC delegation feature, Service for User S4U, did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service principal allowed to delegate could use this flaw to impersonate a non-forwardable user...

November 14, 2021—KB5008602(OS Build 17763.2305) Out-of-band

None None...

July 13, 2021—KB5004302 (Security-only update)

None None...

July 13, 2021—KB5004299 (Security-only update)

None None...

July 13, 2021—KB5004285 (Security-only update)

None None...

July 13, 2021—KB5004305 (Monthly Rollup)

None None...

July 13, 2021—KB5004307 (Security-only update)

None None...

November 19, 2020—KB4594441 (OS Build 14393.4048) Out-of-band

None None...

Kerberos authentication and ticket renewal issues on Windows Server 2012 R2 - Out-of-band

Kerberos authentication and ticket renewal issues on Windows Server 2012 R2 - Out-of-band Applies to: Windows Server 2012 R2 Windows Server 2012 R2 Server Core installation NEW 11/17/20 For information about Windows update terminology, see the article about the types of Windows updates and the...

Fedora 32 : 2:samba / krb5 (2020-939681213a)

KRB5 : - Cross-realm s4u fixes for samba 1836630 - Drop unnecessary conflict with openssl-libs = 3.0.0 - Unify kvno option documentation - Use systemctl reload to HUP the KDC during logrotate SAMBA : - Support S4U operations for Samba AD DC 1836630 - Fix lookup of users and groups when realm used...

EulerOS Virtualization 3.0.6.0 : samba (EulerOS-SA-2020-1746)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U MS-SFU Kerbero...

EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-1032)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to,...

Samba 4.x < 4.9.17 / 4.10.x < 4.10.11 / 4.11.x < 4.11.3 Multiple Vulnerabilities

The version of Samba running on the remote host is 4.x prior to 4.9.17, 4.10.x prior to 4.10.11, or 4.11.x prior to 4.11.3. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability exists in the ldbqsort and dnsnamecompare routines due to how the routines...

Authentication flaw

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U MS-SFU Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos...

Microsoft Windows - DeviceApi CMApi User Hive Impersonation Privilege Escalation (MS16-124)

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=875 Windows: DeviceApi CMApi User Hive Impersonation EoP Platform: Windows 10 10586 not tested 8.1 Update 2 or Windows 7 Class: Elevation of Privilege Summary: The DeviceApi CMApi PnpCtxRegOpenCurrentUserKey function doesn’t chec...