CVE-2020-17049: Kerberos Bronze Bit Attack – Theory

Practical exploitation of Bronze Bit (CVE-2020-17049): attackers with a service account hash can bypass Protected Users and TrustedToAuthForDelegation restrictions to abuse Kerberos delegation paths.

Overview of the Bronze Bit attack (CVE-2020-17049), which abuses Kerberos constrained delegation by flipping the forwardable flag on service tickets to impersonate users marked as sensitive.

Resource-based constrained delegation (RBCD) lets admins delegate access per resource via msDS-AllowedToActOnBehalfOfOtherIdentity, reducing privilege risk—but misconfiguration can be abused.

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.

Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.