PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Domain Takeover via Kerberos Unconstrained Delegation

blog.sentry.security | blog | #active-directory | #kerberos | #red-team | #mitigation | #unconstrained-delegation | #domain-takeover | #tgt
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How attackers abuse Active Directory unconstrained delegation: coercing a DC to authenticate to a compromised host captures its TGT, enabling DCSync, Golden Tickets and full domain takeover.
Published
Collected

Related coverage

blog · semperis.com
Unconstrained Delegation in Active Directory
Why unconstrained delegation is among AD's worst security gaps: it lets a computer store users' Kerberos tickets and impersonate them, making it a prime target; removing the setting eliminates a weak link in trusted authentication chains.
vulnerability · netspi.com
CVE-2025-21299 and CVE-2025-29809: Unguarding Microsoft Credential Guard
CVE-2025-21299 and CVE-2025-29809 are Kerberos feature bypasses: insufficient validation of the krbtgt service name in TGTs lets attackers bypass Credential Guard and extract protected primary TGTs.
vulnerability · horizon3.ai
From CVE-2022-33679 to Unauthenticated Kerberoasting
On September 13, 2022, a new Kerberos vulnerability was published on the Microsoft Security Response Center’s security site. It’s labeled as a Windows Kerberos…
blog · blog.sentry.security
ESC8 Attack Guide for Windows Environments
The ESC8 attack abuses AD CS Web Enrollment with NTLM relay: coercing a DC to authenticate hands attackers a certificate as that high-privilege account, potentially compromising the entire domain.
blog · bughunters.google.com
Project Rain:L1TF
A detailed overview of L1TF, a CPU vulnerability affecting some Intel CPUs (Skylake and older), including how it can be exploited and possible mitigation strategies.
blog · blog.trailofbits.com
Use GWP-ASan to detect exploits in production environments
GWP-ASan is a sampling-based memory error detector that catches use-after-free, double-free, and heap overflows in production at near-zero overhead, where AddressSanitizer's 2-4x cost is too heavy.
Back