Letting KDC Proxy Do the Dirty Work: DNS Poisoning for Credential Harvesting
The Windows KDC Proxy (KPSSVC, the service behind MS-KKDCP) is one of those components that quietly ends up internet-facing and rarely gets a second look. It...
Recent Posts
The Call Is Coming From Inside the House: Unauthenticated Kerberos relay and IP laundering in the Windows KDC Proxy
I spent a few weeks living inside the Windows KDC Proxy, and the short version is that it does exactly what it was designed to do, which turns out to be the ...
HackTheBox: Ghost
This box is rated insane difficulty on HTB. It involves us exploiting a wide range of techniques from LDAP and command injection to crafting Golden SAML resp...
Trust Me, I Did MFA
Most of my time goes into how the Windows KDC decides who you get to be and what ends up in your PAC. This one started with a smaller question that had been ...
I NSPI With My Little Eye: Enumerating Active Directory Through Exchange’s Address Book Interface
Every mature blue team eventually builds detection for SharpHound. The LDAP-sweep signature is well-understood: a single source account issuing hundreds of q...
Five SCEP Servers, One Harness: A Cross-Implementation Differential
SCEP is the protocol that quietly issues a large share of the certificates on a modern network. Every MDM-enrolled phone, every Intune or Jamf device, and ev...
The Web-Facing ESC6: SAN Injection Over CEP/CES
The Certificate Enrollment Web Service (CES) forwards a SAN AdditionalContext ContextItem to the CA as a SAN request attribute. Where EDITF_ATTRIBUTESUBJECTA...
User-to-User Kerberos, Acceptor-Side: A Cross-Stack Characterization
Why U2U, and why the acceptor side
The Authenticator Nobody Reads: Characterizing Non-PAC Kerberos AuthorizationData (ad-types 141-144)
Everyone who studies Kerberos authorization studies the PAC. It is where the group memberships live, it is what the KDC signs, and it is what a decade of del...
Kerberos Secret Caching, Hub Forwarding, and Account Revocation Behavior
Executive Summary