MS14-068
CVE-2014-6324
Last updated
Was this helpful?
CVE-2014-6324
Last updated
Was this helpful?
This vulnerability allows attackers to forge a TGT with high privileges (i.e. with a modified PAC stating the user is a member of privileged groups). This attack is similar to the , however, it doesn't require the attacker to know the krbtgt. This attack is a really powerful privilege escalation technique, however, it relies on a 2014 bug and will not work on patched domain controllers.
This vulnerability is possible due to a misvalidation of the PAC signature, allowing to craft a PAC granting powerful rights to a user while still being legitimate in the eyes of the KDC(Key Distribution Center). Contrary to what Microsoft doc states , there are more than three SignatureTypes accepted by the KDC : before MS14-068 patch, a signature was considered valid by KdcVerifyPacSignature if its size was <= 20 bytes. Therefore, it was possible to sign a PAC with a non-keyed hashing algorithm such as MD5 and have this PAC be considered valid.
The exploitation goes as follow:
A PAC-less TGT is obtained via an AS-REQ with the PA-PAC-REQUEST attribute set to false. This will be used in a later step.
A PAC indicating an account membership to powerful groups in the domain is forged and "signed" with MD5 (or any other non-keyed algorithm listed ).
A TGS-REQ message, requesting a service ticket targeting the KRBTGT service (i.e. a TGT-like) is sent to the vulnerable KDC, using the forged PAC from step (2) encrypted with a sub-session key (usually the session key) and included in the TGT from step (1).
In response to step (3), a new TGT containing the forged PAC will be received from the vulnerable KDC after its validation of the forged PAC (the vulnerability happens here).
The newly obtained TGT can be use like a , with , to perform privileged various actions.
PyKEK
This attack can be operated with 's Python script. The script can carry out the attack with a cleartext password or with .
In order to operate the attack, knowing a domain account’s name, its password (or hash) and its SID are needed.
A TGT can then be obtained with one of the following commands.
Once the .ccache TGT is obtained, if the attack is successful, the ticket will be usable with . An easy way to check if the TGT works is to use it and ask for a service ticket. This can be done with Impacket's (Python).
This step will only make sure the TGT works though. It will not indicate for sure that the attack worked. This is because a patched DC could ignore the forged PAC and include a legitimate PAC instead. But the TGT would still be valid. It would simply be "unprivileged". Trying to use the service ticket for a privileged taks, for instance, is advised.
In some scenarios, I personally have had trouble using the .ccache ticket on UNIX-like systems. What I did was to .kirbi, switch to a Windows system, inject the ticket with mimikatz's using command, and then create a new user and add it to the domain admins group.
Impacket (goldenPac.py)
The attack can also be carried out automatically using Impacket's (Python). This tool conducts the attack and tries to open a privileged session using the obtained TGT and PsExec. The TGT can be stored locally with the -w path parameter.
Metasploit Framework
The Metasploit Framework can also be useful in the sense that it prints valuable error information.
Prerequisite : Build ms14068.exe following .
Parts of this page were written with the help of the AI model.
