CVE-2020-17049: Kerberos Bronze Bit Attack – Practical Exploitation

Overview of the Bronze Bit attack (CVE-2020-17049), which abuses Kerberos constrained delegation by flipping the forwardable flag on service tickets to impersonate users marked as sensitive.

Theory behind the Kerberos Bronze Bit attack (CVE-2020-17049), which abuses a KDC flaw to bypass delegation checks in resource-based constrained delegation attacks against Active Directory.

Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

Elad Shamir details SPN-jacking: with WriteSPN rights over a target SPN and another service account, an attacker lacking SeEnableDelegation can temporarily hijack the SPN and run a full S4U attack—reviving dead-end paths.

CVE-2025-21299 and CVE-2025-29809 are Kerberos feature bypasses: insufficient validation of the krbtgt service name in TGTs lets attackers bypass Credential Guard and extract protected primary TGTs.