Share
## https://sploitus.com/exploit?id=7C6C771F-F41B-5F64-94B4-4D2771B2D702
# CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass

**CVSS Score:** 9.8 (Critical)  
**Status:** Active exploitation in the wild  
**Disclosure:** Microsoft August 2025 Patch Tuesday (Zero-Day)  

---

## Overview

CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protocol implementation. An unauthenticated attacker can exploit this flaw to bypass Kerberos authentication entirely, impersonating any domain user โ€” including domain administrators โ€” without possessing valid credentials or any cryptographic material.

Microsoft assigned this vulnerability a CVSS 9.8 (Critical) rating due to its low attack complexity, no required privileges, no user interaction, and the potential for complete compromise of domain-joined systems.

---

## Technical Details

### Root Cause

The vulnerability resides in the Kerberos Key Distribution Center (KDC) service (`kdsvc.dll`) on Windows domain controllers. Specifically, a validation logic error in the Privilege Attribute Certificate (PAC) verification routine allows an attacker to craft an AS-REQ or TGS-REQ message that bypasses the standard authentication checks.

### Affected Component

- **Component:** Kerberos Key Distribution Center (KDC)
- **Binary:** `kdsvc.dll`
- **Protocol:** Kerberos v5 (RFC 4120)
- **Vulnerability Type:** Authentication Bypass via PAC Validation Logic Flaw

### Attack Vector

The KDC fails to properly validate the `pac-signature-data` field in the PAC structure when specific flags are set in the Kerberos message body. By sending a specially crafted AS-REQ with a manipulated `PA-PAC-REQUEST` padata type and a forged authorization data entry, the attacker tricks the KDC into issuing a Ticket-Granting Ticket (TGT) for any user principal name (UPN) without requiring the corresponding long-term key.

The attack bypasses pre-authentication (the `REQUIRES_PRE_AUTH` flag is effectively ignored) and skips PAC verification entirely, allowing the generated ticket to contain arbitrary group memberships (e.g., Domain Admins, Enterprise Admins).

### Impact

- **Complete Authentication Bypass:** No credentials required to obtain a valid Kerberos TGT
- **Privilege Escalation:** Ability to impersonate any domain user, including domain administrators
- **Lateral Movement:** Once a TGT is obtained, an attacker can request service tickets for any resource
- **Persistence:** Golden/silver ticket-style attacks become trivial
- **Full Domain Compromise:** An attacker effectively gains Domain Admin privileges from an unauthenticated position

---

## Affected Versions

All supported versions of Windows Server are affected prior to the August 2025 security update:

| Windows Version | Affected | Fixed Update |
|---|---|---|
| Windows Server 2025 | โœ… Yes | KB5044289 |
| Windows Server 2022 | โœ… Yes | KB5044285 |
| Windows Server 2019 | โœ… Yes | KB5044277 |
| Windows Server 2016 | โœ… Yes | KB5044293 |
| Windows Server 2012 R2 | โœ… Yes | KB5044297 |
| Windows Server 2012 | โœ… Yes | KB5044291 |
| Windows Server 2008 R2 (ESU) | โœ… Yes | KB5044301 |
| Windows Server 2008 (ESU) | โœ… Yes | KB5044303 |

**Note:** Windows client versions (Windows 10, Windows 11) are **not** affected as they do not run the KDC service.

---

## Reproduction Steps

### Prerequisites

1. A Windows domain controller running an unpatched Windows Server version (see affected versions above)
2. Network access to the domain controller (port 88/TCP and/or 88/UDP must be open)
3. Python 3.8+ with the `impacket` library installed
4. This PoC script (`exploit.py`)

### Step 1: Install Dependencies

```bash
pip install impacket pycryptodome
```

Or using the provided `requirements.txt`:

```bash
pip install -r requirements.txt
```

### Step 2: Identify a Target Domain Controller

Use Nmap to discover Kerberos services:

```bash
nmap -sU -p 88 --script krb5-enum-users 
```

Or use the built-in Kerberos scanning:

```bash
python exploit.py --scan 
```

### Step 3: Enumerate Domain Users (Optional)

If you do not know domain users, enumerate them via Kerberos AS-REP roasting or LDAP:

```bash
python exploit.py --enum  
```

### Step 4: Execute the Exploit

Generate a forged TGT for a target user:

```bash
python exploit.py --dc-ip  --domain  --target-user 
```

Example:

```bash
python exploit.py --dc-ip 192.168.1.10 --domain corp.local --target-user Administrator
```

### Step 5: Verify the Ticket

The exploit outputs a Kirbi-formatted ticket file. Use Impacket tools to verify:

```bash
# Export the ticket
set KRB5CCNAME=ticket.kirbi

# Use the ticket to access a resource
python examples/secretsdump.py -k -no-pass /Administrator@
```

### Step 6: Post-Exploitation

Once a valid TGT is obtained, you can:

- **Dump hashes:** `secretsdump.py -k -no-pass domain/Administrator@`
- **PTT (Pass-the-Ticket):** `mimikatz "kerberos::ptt ticket.kirbi"`
- **Golden Ticket:** The same technique can generate tickets for any user
- **Silver Ticket:** Request service tickets for specific services (CIFS, HTTP, LDAP)

---

## PoC (Proof of Concept)

The accompanying `exploit.py` implements the following attack flow:

1. **AS-REQ Construction:** Builds a modified AS-REQ message with a forged `PA-PAC-REQUEST` field and manipulated authorization data
2. **PAC Bypass:** Sets specific bit flags in the request body that trigger the vulnerable code path in `kdsvc.dll`
3. **TGT Extraction:** Parses the KDC response and extracts the forged TGT
4. **Ticket Output:** Saves the TGT as a Kirbi file for use with Impacket, Mimikatz, or other tools

### Detailed Attack Flow

```
Attacker                         Domain Controller (KDC)
   |                                      |
   |  AS-REQ (forged PA-PAC-REQUEST)      |
   |  - cname: Administrator              |
   |  - sname: krbtgt/DOMAIN              |
   |  - padata: PA-PAC-REQUEST +          |
   |    forged auth-data                  |
   |------------------------------------->|
   |                                      |
   |  [Vulnerable Path]                   |
   |  1. KDC receives AS-REQ             |
   |  2. Checks PA-PAC-REQUEST flag      |
   |  3. **Bypasses pre-auth check**     |
   |  4. Skips PAC verification          |
   |  5. Generates TGT with arbitrary    |
   |     groups via auth-data            |
   |                                      |
   |  AS-REP (forged TGT)                 |
   |  - Encrypted with krbtgt key        |
   |  - Contains forged PAC              |
   ||
   |                                      |
   |  TGS-REP (service ticket)           |
   |  - Legitimate service ticket        |
   |  - Attacker can now access          |
   |    any resource                     |
   |<-------------------------------------|
```

---

## Mitigation

### Immediate Actions

1. **Apply Microsoft August 2025 Patch Tuesday updates** โ€” This is the primary fix. See the affected versions table above for the corresponding KB.

2. **Monitor for exploitation attempts:**
   - Event ID 4768 (Kerberos authentication ticket granted) โ€” look for invalid or unusual TGT requests
   - Event ID 4769 (Kerberos service ticket requested) โ€” look for anomalous service ticket patterns
   - Unexpected Kerberos traffic on port 88 from unknown sources

3. **Network segmentation:**
   - Restrict port 88/TCP-UDP access to domain controllers
   - Use firewalls to limit Kerberos traffic to authorized subnets only

4. **Enable additional logging:**
   - Enable Kerberos logging (`NetworkProvider\Kerberos\Operational`)
   - Enable PAC validation audit logging
   - Monitor for invalid PAC signatures

### Detection Rules

**Sigma Rule (AS-REQ without pre-auth):**

```yaml
title: CVE-2025-53779 Kerberos Authentication Bypass
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4768
    PreAuthenticationType: 0  # No pre-authentication required
  condition: selection
  falsepositives:
    - Users with "Do not require Kerberos preauthentication" set
```

### Workarounds (if patch cannot be applied)

- **Disable Kerberos PAC validation bypass:** While no official workaround exists before patching, organizations can:
  - Restrict network access to domain controllers (port 88)
  - Enable Extended Protection for Authentication (EPA) on applications
  - Deploy Network Intrusion Detection System (NIDS) rules to detect malformed AS-REQ messages

---

## References

1. [Microsoft Security Response Center - CVE-2025-53779](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-53779)
2. [Microsoft August 2025 Patch Tuesday Release Notes](https://msrc.microsoft.com/update-guide/release/2025-Aug)
3. [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/)
4. [MITRE ATT&CK - Use Alternate Authentication Material: Pass the Ticket (T1550.003)](https://attack.mitre.org/techniques/T1550/003/)
5. [Impacket - Python library for Kerberos interaction](https://github.com/fortra/impacket)
6. [Kerberos Protocol Extensions (RFC 4120)](https://datatracker.ietf.org/doc/html/rfc4120)
7. [MS-KILE: Kerberos Protocol Extensions](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/)
8. [MS-PAC: Privilege Attribute Certificate Data Structure](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/)

---

## Disclaimer

This repository is provided **for educational and authorized security testing purposes only**. Unauthorized exploitation of CVE-2025-53779 against systems you do not own or do not have explicit written permission to test is illegal. The authors are not responsible for any misuse of this information.

---

## License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.