What Windows Server 2025 Full PAC Validation Actually Checks
The question
Recent Posts
PACMutator: Fuzzing the PAC Validator Instead of Forging Tickets
What a PAC is, and why it is worth attacking
HackTheBox: Mirage
This box is rated hard difficulty on HTB. It involves us finding an exported NFS share containing sensitive PDF documents which disclose a missing DNS record...
Testing the Windows Server 2025 PKINIT Algorithm-Agility Downgrade Surface
PKINIT gained real cryptographic agility over the last few years. RFC 8636 added key-derivation negotiation, RFC 8070 added freshness, and Microsoft’s MS-PKC...
Kerberos to an IP Address, Part 4: Why It Is Contained, and Where Detection Falls Short
Part 3 showed that enabling the IP SPN client path changes coerced authentication from NTLM to Kerberos when the destination carries an IP SPN, for both memb...
Kerberos to an IP Address, Part 3: Coercion Behavior and What a Ticket Exposes
Parts 1 and 2 stayed on the mechanism: Kerberos to an IP works, gated on an SPN existing, and registering an arbitrary IP SPN requires unconstrained write ov...
Kerberos to an IP Address, Part 2: Who Can Register an IP SPN
Part 1 established that Kerberos to an IP address works, and that the single gate between a failed local resolution and a working ticket is whether an IP-bas...
Kerberos to an IP Address, Part 1: What IP SPN Actually Does
For as long as most of us have worked with Active Directory, one rule held: Kerberos needs a name. Connect to a file share by hostname and you get a Kerberos...
HackTheBox: Hercules
This box is rated insane difficulty on HTB. It involves us enumerating passwords via LDAP injection on a web server, password spraying, finding a file disclo...
Impel: Mapping the RPC Coercion Surface on Windows Server 2025
This post covers Impel, a Linux-native RPC coercion surface scanner we built as the final tool in our Windows authentication coercion research series. The pr...