CVE-2020-17049: Kerberos Bronze Bit Attack – Overview

Practical exploitation of Bronze Bit (CVE-2020-17049): attackers with a service account hash can bypass Protected Users and TrustedToAuthForDelegation restrictions to abuse Kerberos delegation paths.

Theory behind the Kerberos Bronze Bit attack (CVE-2020-17049), which abuses a KDC flaw to bypass delegation checks in resource-based constrained delegation attacks against Active Directory.

Elad Shamir details SPN-jacking: with WriteSPN rights over a target SPN and another service account, an attacker lacking SeEnableDelegation can temporarily hijack the SPN and run a full S4U attack—reviving dead-end paths.

CVE-2025-21299 and CVE-2025-29809 are Kerberos feature bypasses: insufficient validation of the krbtgt service name in TGTs lets attackers bypass Credential Guard and extract protected primary TGTs.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Resource-based constrained delegation (RBCD) lets admins delegate access per resource via msDS-AllowedToActOnBehalfOfOtherIdentity, reducing privilege risk—but misconfiguration can be abused.