Skip to content
RC4 Is Still Considered Harmful
Summary
I've been spending a lot of time researching Windows authentication implementations, specifically Kerberos. In June 2022 I found an interesting issue number 2310 with the handling of RC4 encryption that allowed you to authenticate as another user if you could either interpose on the Kerberos network traffic to and from the KDC or directly if the user was configured to disable typical pre-authentication requirements.
- Published
- Collected
Related coverage
blog ·
projectzero.google
This shouldn't have happened: A vulnerability postmortem
/* cyrillic */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOEDuSfQZQ.woff2) format('woff2'); unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116; } /* hebrew */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOECOSfQZQ.woff2) format('woff2'); unicode-range: U+0307-0308, U+0590-05FF, U+200C-2010, U+20AA, U+25CC, U+FB1D-FB4F; } /* vietnamese */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOEBeSfQZQ.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB; } /* latin-ext */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOEBOSfQZQ.woff2) format('woff2'); unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF; } /* latin */ @font-face { font-family: 'Amatic SC'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/s/amaticsc/v28/TUZyzwprpvBS1izr_vOECuSf.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } /* latin */ @font-face { font-family: 'Consolas'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/l/font?kit=X7nm4bA-A_-9jbjWaza9xMk&skey=3d1eb1871fcc58a1&v=v20) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } @import url('https://themes.googleusercontent.com/fonts/css?kit=t66UaDGGO9uRFa9A_n0Ge4kPz49mG1-u2NJpkhDAP5E'); .post-body{.lst-kix_q4elz23jmthh-5>li{counter-increment:lst-ctn-kix_q4elz23jmthh-5}ol.lst-kix_q4elz23jmthh-6.start{counter-reset:lst-ctn-kix_q4elz23jmthh-6 0}ul.lst-kix_wy7koemfbmv1-3{list-style-type:none}ul.lst-kix_wy7koemfbmv1-2{list-style-type:none}ul.lst-kix_wy7koemfbmv1-5{list-style-type:none}.lst-kix_2hgb22nra90i-8>li:before{content:"\0025a0 "}ul.lst-kix_wy7koemfbmv1-4{list-style-type:none}ul.lst-kix_wy7koemfbmv1-1{list-style-type:none}.lst-kix_2hgb22nra90i-7>li:before{content:"\0025cb "}ul.lst-kix_wy7koemfbmv1-0{list-style-type:none}ol.lst-kix_q4elz23jmthh-0.start{counter-reset:lst-ctn-kix_q4elz23jmthh-0 0}.lst-kix_2hgb22nra90i-4>li:before{content:"\0025cb "}.lst-kix_2hgb22nra90i-6>li:before{content:"\0025cf "}.lst-kix_2hgb22nra90i-5>li:before{content:"\0025a0 "}ul.lst-kix_z8xtsan2wa5s-5{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-6{list-style-type:none}.lst-kix_q4elz23jmthh-7>li{counter-increment:lst-ctn-kix_q4elz23jmthh-7}ul.lst-kix_z8xtsan2wa5s-7{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-8{list-style-type:none}.lst-kix_2hgb22nra90i-0>li:before{content:"\0025cf "}.lst-kix_2hgb22nra90i-2>li:before{content:"\0025a0 "}.lst-kix_2hgb22nra90i-3>li:before{content:"\0025cf "}ul.lst-kix_z8xtsan2wa5s-0{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-1{list-style-type:none}ul.lst-kix_wy7koemfbmv1-7{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-2{list-style-type:none}ul.lst-kix_wy7koemfbmv1-6{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-3{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-4{list-style-type:none}.lst-kix_2hgb22nra90i-1>li:before{content:"\0025cb "}ul.lst-kix_wy7koemfbmv1-8{list-style-type:none}.lst-kix_q4elz23jmthh-5>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-5,lower-roman) ". "}.lst-kix_q4elz23jmthh-6>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-6,decimal) ". "}.lst-kix_q4elz23jmthh-4>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-4,lower-latin) ". "}.lst-kix_q4elz23jmthh-8>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-8,lower-roman) ". "}.lst-kix_oetzaqvyxxoa-0>li:before{content:"\0025cf "}.lst-kix_oetzaqvyxxoa-1>li:before{content:"\0025cb "}.lst-kix_oetzaqvyxxoa-2>li:before{content:"\0025a0 "}.lst-kix_oetzaqvyxxoa-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-7>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-7,lower-latin) ". "}.lst-kix_q4elz23jmthh-0>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-0,decimal) ". "}.lst-kix_q4elz23jmthh-1>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-1,lower-latin) ". "}.lst-kix_q4elz23jmthh-2>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-2,lower-roman) ". "}.lst-kix_q4elz23jmthh-3>li{counter-increment:lst-ctn-kix_q4elz23jmthh-3}.lst-kix_q4elz23jmthh-3>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-3,decimal) ". "}ul.lst-kix_ohd9cwgi2ci1-5{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-4{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-7{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-6{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-8{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-2{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-3{list-style-type:none}.lst-kix_oetzaqvyxxoa-6>li:before{content:"\0025cf "}.lst-kix_oetzaqvyxxoa-7>li:before{content:"\0025cb "}ul.lst-kix_ugjdqlaeq7aq-0{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-1{list-style-type:none}ol.lst-kix_q4elz23jmthh-5.start{counter-reset:lst-ctn-kix_q4elz23jmthh-5 0}ul.lst-kix_ugjdqlaeq7aq-6{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-7{list-style-type:none}.lst-kix_oetzaqvyxxoa-4>li:before{content:"\0025cb "}.lst-kix_oetzaqvyxxoa-5>li:before{content:"\0025a0 "}.lst-kix_oetzaqvyxxoa-8>li:before{content:"\0025a0 "}ul.lst-kix_ugjdqlaeq7aq-4{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-5{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-8{list-style-type:none}.lst-kix_x7i5vtjupm2f-2>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-6>li:before{content:"\0025cf "}ul.lst-kix_2fd9br43vo52-4{list-style-type:none}ul.lst-kix_2fd9br43vo52-3{list-style-type:none}.lst-kix_ohd9cwgi2ci1-3>li:before{content:"\0025cf "}ul.lst-kix_2fd9br43vo52-6{list-style-type:none}ul.lst-kix_2fd9br43vo52-5{list-style-type:none}ul.lst-kix_2fd9br43vo52-8{list-style-type:none}.lst-kix_fvn7czyjg1wz-2>li:before{content:"\0025a0 "}ul.lst-kix_2fd9br43vo52-7{list-style-type:none}.lst-kix_x7i5vtjupm2f-4>li:before{content:"\0025cb "}.lst-kix_2fd9br43vo52-3>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-4>li:before{content:"\0025cb "}ul.lst-kix_2fd9br43vo52-0{list-style-type:none}.lst-kix_2fd9br43vo52-5>li:before{content:"\0025a0 "}ul.lst-kix_2fd9br43vo52-2{list-style-type:none}ul.lst-kix_2fd9br43vo52-1{list-style-type:none}.lst-kix_4idwybng3hbx-2>li:before{content:"\0025a0 "}.lst-kix_2fd9br43vo52-7>li:before{content:"\0025cb "}.lst-kix_fvn7czyjg1wz-8>li:before{content:"\0025a0 "}.lst-kix_ohd9cwgi2ci1-1>li:before{content:"\0025cb "}.lst-kix_4idwybng3hbx-0>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-6>li:before{content:"\0025cf "}.lst-kix_x7i5vtjupm2f-0>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-8>li:before{content:"\0025a0 "}ul.lst-kix_fvn7czyjg1wz-2{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-1{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-0{list-style-type:none}.lst-kix_wy7koemfbmv1-4>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-6>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-7.start{counter-reset:lst-ctn-kix_q4elz23jmthh-7 0}.lst-kix_wy7koemfbmv1-0>li:before{content:"\0025cf "}.lst-kix_wy7koemfbmv1-2>li:before{content:"\0025a0 "}.lst-kix_ugjdqlaeq7aq-0>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-5>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-7>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-1>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-2>li:before{content:"\0025a0 "}ul.lst-kix_2hgb22nra90i-0{list-style-type:none}ul.lst-kix_2hgb22nra90i-1{list-style-type:none}ul.lst-kix_2hgb22nra90i-2{list-style-type:none}ul.lst-kix_2hgb22nra90i-3{list-style-type:none}.lst-kix_fvn7czyjg1wz-0>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-4>li:before{content:"\0025cb "}ul.lst-kix_2hgb22nra90i-4{list-style-type:none}ul.lst-kix_2hgb22nra90i-5{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-8{list-style-type:none}ul.lst-kix_2hgb22nra90i-6{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-7{list-style-type:none}ul.lst-kix_2hgb22nra90i-7{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-6{list-style-type:none}ul.lst-kix_2hgb22nra90i-8{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-5{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-4{list-style-type:none}.lst-kix_x7i5vtjupm2f-8>li:before{content:"\0025a0 "}ul.lst-kix_fvn7czyjg1wz-3{list-style-type:none}ul.lst-kix_81cegzboe9ky-8{list-style-type:none}ul.lst-kix_81cegzboe9ky-5{list-style-type:none}ul.lst-kix_81cegzboe9ky-4{list-style-type:none}ul.lst-kix_81cegzboe9ky-7{list-style-type:none}ul.lst-kix_81cegzboe9ky-6{list-style-type:none}ol.lst-kix_q4elz23jmthh-8.start{counter-reset:lst-ctn-kix_q4elz23jmthh-8 0}ul.lst-kix_oetzaqvyxxoa-2{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-3{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-0{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-1{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-6{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-7{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-4{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-5{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-8{list-style-type:none}ul.lst-kix_4idwybng3hbx-5{list-style-type:none}ul.lst-kix_4idwybng3hbx-4{list-style-type:none}.lst-kix_81cegzboe9ky-2>li:before{content:"\0025a0 "}.lst-kix_81cegzboe9ky-4>li:before{content:"\0025cb "}ul.lst-kix_4idwybng3hbx-7{list-style-type:none}ul.lst-kix_4idwybng3hbx-6{list-style-type:none}.lst-kix_wy7koemfbmv1-6>li:before{content:"\0025cf "}ul.lst-kix_4idwybng3hbx-8{list-style-type:none}.lst-kix_2gk0zovl15u8-4>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-0>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-6>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-8>li:before{content:"\0025a0 "}.lst-kix_wy7koemfbmv1-8>li:before{content:"\0025a0 "}ul.lst-kix_4idwybng3hbx-1{list-style-type:none}ul.lst-kix_4idwybng3hbx-0{list-style-type:none}ul.lst-kix_4idwybng3hbx-3{list-style-type:none}.lst-kix_2gk0zovl15u8-6>li:before{content:"\0025cf "}ul.lst-kix_4idwybng3hbx-2{list-style-type:none}.lst-kix_prwgb47nvxz6-8>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-8>li:before{content:"\0025a0 "}ul.lst-kix_81cegzboe9ky-1{list-style-type:none}ul.lst-kix_81cegzboe9ky-0{list-style-type:none}ul.lst-kix_81cegzboe9ky-3{list-style-type:none}ul.lst-kix_81cegzboe9ky-2{list-style-type:none}.lst-kix_z8xtsan2wa5s-3>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-2>li:before{content:"\0025a0 "}.lst-kix_z8xtsan2wa5s-4>li:before{content:"\0025cb "}.lst-kix_prwgb47nvxz6-0>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-1>li:before{content:"\0025cb "}.lst-kix_z8xtsan2wa5s-5>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-1>li:before{content:"\0025cb "}ol.lst-kix_q4elz23jmthh-4{list-style-type:none}ol.lst-kix_q4elz23jmthh-3{list-style-type:none}ol.lst-kix_q4elz23jmthh-3.start{counter-reset:lst-ctn-kix_q4elz23jmthh-3 0}ol.lst-kix_q4elz23jmthh-6{list-style-type:none}ol.lst-kix_q4elz23jmthh-5{list-style-type:none}ol.lst-kix_q4elz23jmthh-0{list-style-type:none}ol.lst-kix_q4elz23jmthh-2{list-style-type:none}ol.lst-kix_q4elz23jmthh-1{list-style-type:none}.lst-kix_prwgb47nvxz6-6>li:before{content:"\0025cf "}.lst-kix_prwgb47nvxz6-5>li:before{content:"\0025a0 "}.lst-kix_z8xtsan2wa5s-7>li:before{content:"\0025cb "}.lst-kix_prwgb47nvxz6-3>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-6>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-8>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-2>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-4>li:before{content:"\0025cb "}.lst-kix_2gk0zovl15u8-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-6>li{counter-increment:lst-ctn-kix_q4elz23jmthh-6}.lst-kix_2gk0zovl15u8-2>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-1>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-8>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-6>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-7>li:before{content:"\0025cb "}.lst-kix_q4elz23jmthh-4>li{counter-increment:lst-ctn-kix_q4elz23jmthh-4}ol.lst-kix_q4elz23jmthh-8{list-style-type:none}ol.lst-kix_q4elz23jmthh-7{list-style-type:none}.lst-kix_z8xtsan2wa5s-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-2>li:before{content:"\0025a0 "}.lst-kix_cw1yal3teuur-3>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-4.start{counter-reset:lst-ctn-kix_q4elz23jmthh-4 0}.lst-kix_cw1yal3teuur-1>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-4>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-5>li:before{content:"\0025a0 "}.lst-kix_4idwybng3hbx-6>li:before{content:"\0025cf "}.lst-kix_4idwybng3hbx-5>li:before{content:"\0025a0 "}.lst-kix_4idwybng3hbx-7>li:before{content:"\0025cb "}.lst-kix_q4elz23jmthh-0>li{counter-increment:lst-ctn-kix_q4elz23jmthh-0}.lst-kix_4idwybng3hbx-3>li:before{content:"\0025cf "}.lst-kix_4idwybng3hbx-4>li:before{content:"\0025cb "}.lst-kix_4idwybng3hbx-8>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-5>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-7>li:before{content:"\0025cb "}.lst-kix_x7i5vtjupm2f-3>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-4>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-2>li:before{content:"\0025a0 "}.lst-kix_fvn7czyjg1wz-3>li:before{content:"\0025cf "}ul.lst-kix_x7i5vtjupm2f-8{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-1{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-4{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-0{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-5{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-3{list-style-type:none}.lst-kix_2fd9br43vo52-4>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-6{list-style-type:none}.lst-kix_fvn7czyjg1wz-5>li:before{content:"\0025a0 "}ul.lst-kix_ohd9cwgi2ci1-2{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-7{list-style-type:none}.lst-kix_ohd9cwgi2ci1-2>li:before{content:"\0025a0 "}ul.lst-kix_x7i5vtjupm2f-0{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-1{list-style-type:none}ul.lst-kix_prwgb47nvxz6-8{list-style-type:none}.lst-kix_4idwybng3hbx-1>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-2{list-style-type:none}.lst-kix_x7i5vtjupm2f-1>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-3{list-style-type:none}.lst-kix_ohd9cwgi2ci1-0>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-6>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-7>li:before{content:"\0025cb "}.lst-kix_wy7koemfbmv1-5>li:before{content:"\0025a0 "}ul.lst-kix_prwgb47nvxz6-2{list-style-type:none}ul.lst-kix_prwgb47nvxz6-3{list-style-type:none}ul.lst-kix_prwgb47nvxz6-0{list-style-type:none}ul.lst-kix_prwgb47nvxz6-1{list-style-type:none}ul.lst-kix_prwgb47nvxz6-6{list-style-type:none}ul.lst-kix_prwgb47nvxz6-7{list-style-type:none}ul.lst-kix_prwgb47nvxz6-4{list-style-type:none}ul.lst-kix_prwgb47nvxz6-5{list-style-type:none}.lst-kix_wy7koemfbmv1-3>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-7>li:before{content:"\0025cb "}.lst-kix_wy7koemfbmv1-1>li:before{content:"\0025cb "}.lst-kix_ohd9cwgi2ci1-6>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-1>li:before{content:"\0025cb "}.lst-kix_2fd9br43vo52-0>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-1>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-5>li:before{content:"\0025a0 "}.lst-kix_ugjdqlaeq7aq-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-1>li{counter-increment:lst-ctn-kix_q4elz23jmthh-1}.lst-kix_ohd9cwgi2ci1-8>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-1.start{counter-reset:lst-ctn-kix_q4elz23jmthh-1 0}.lst-kix_q4elz23jmthh-8>li{counter-increment:lst-ctn-kix_q4elz23jmthh-8}.lst-kix_q4elz23jmthh-2>li{counter-increment:lst-ctn-kix_q4elz23jmthh-2}.lst-kix_81cegzboe9ky-3>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-1>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-5>li:before{content:"\0025a0 "}.lst-kix_2fd9br43vo52-8>li:before{content:"\0025a0 "}.lst-kix_wy7koemfbmv1-7>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-7>li:before{content:"\0025cb "}.lst-kix_2gk0zovl15u8-5>li:before{content:"\0025a0 "}ul.lst-kix_2gk0zovl15u8-0{list-style-type:none}ul.lst-kix_2gk0zovl15u8-2{list-style-type:none}.lst-kix_2gk0zovl15u8-7>li:before{content:"\0025cb "}ul.lst-kix_2gk0zovl15u8-1{list-style-type:none}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ul.lst-kix_2gk0zovl15u8-4{list-style-type:none}ul.lst-kix_2gk0zovl15u8-3{list-style-type:none}ul.lst-kix_cw1yal3teuur-5{list-style-type:none}.lst-kix_prwgb47nvxz6-7>li:before{content:"\0025cb "}ul.lst-kix_2gk0zovl15u8-6{list-style-type:none}ul.lst-kix_cw1yal3teuur-4{list-style-type:none}ul.lst-kix_2gk0zovl15u8-5{list-style-type:none}ul.lst-kix_cw1yal3teuur-7{list-style-type:none}ul.lst-kix_2gk0zovl15u8-8{list-style-type:none}ul.lst-kix_cw1yal3teuur-6{list-style-type:none}ul.lst-kix_2gk0zovl15u8-7{list-style-type:none}ul.lst-kix_cw1yal3teuur-8{list-style-type:none}ul.lst-kix_cw1yal3teuur-1{list-style-type:none}ol.lst-kix_q4elz23jmthh-2.start{counter-reset:lst-ctn-kix_q4elz23jmthh-2 0}ul.lst-kix_cw1yal3teuur-0{list-style-type:none}ul.lst-kix_cw1yal3teuur-3{list-style-type:none}ul.lst-kix_cw1yal3teuur-2{list-style-type:none}ol{margin:0;padding:0}table td,table th{padding:0}.c15{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c6{color:#000000;font-weight:700;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:italic}.c2{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c31{background-color:#ffffff;padding-top:0pt;padding-bottom:0pt;line-height:1.3;text-align:left;height:11pt}.c13{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c19{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#009900;font-weight:400}.c34{background-color:#ffffff;padding-top:0pt;padding-bottom:0pt;line-height:1.3;text-align:left}.c12{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#993333;font-weight:400}.c1{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#212529;font-weight:400}.c45{color:#333333;text-decoration:none;vertical-align:baseline;font-size:30pt;font-family:"Amatic SC"}.c7{font-size:8pt;font-family:Consolas,"Courier New";color:#333333;font-weight:400}.c4{margin-left:36pt;border-spacing:0;border-collapse:collapse;margin-right:auto}.c14{border-spacing:0;border-collapse:collapse;margin-right:auto}.c26{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c11{color:#000000;font-weight:400;font-size:11pt;font-family:"Arial"}.c3{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c10{font-size:8pt;font-family:Consolas,"Courier New";color:#0000ff;font-weight:400}.c40{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:center}.c24{color:#000000;font-weight:700;font-size:11pt;font-family:"Arial"}.c0{font-size:9pt;font-family:Consolas,"Courier New";color:#333333;font-weight:400}.c18{font-size:8pt;font-family:Consolas,"Courier New";color:#008080;font-weight:400}.c5{font-size:9pt;font-family:Consolas,"Courier New";color:#0000ff;font-weight:400}.c30{color:#000000;font-weight:400;font-size:10pt;font-family:"Arial"}.c42{background-color:#ffffff;font-size:8pt;color:#b1b100}.c47{font-weight:400;font-size:8pt;font-family:"Arial"}.c28{background-color:#ffffff;font-size:8pt;color:#000066}.c38{background-color:#ffffff;font-size:8pt;color:#ff0000}.c23{background-color:#ffffff;font-size:8pt;color:#339933}.c8{text-decoration:none;vertical-align:baseline;font-style:normal}.c50{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c46{text-decoration:none;vertical-align:baseline;font-style:italic}.c51{background-color:#ffffff;font-size:8pt;color:#0000dd}.c9{color:inherit;text-decoration:inherit}.c27{margin-left:36pt;padding-left:0pt}.c17{padding:0;margin:0}.c22{font-size:9pt;color:#008000}.c21{font-weight:400;font-family:Consolas,"Courier New"}.c33{orphans:2;widows:2}.c44{width:33%;height:1px}.c35{font-weight:400;font-style:italic}.c48{font-size:8pt;color:#8b0000}.c29{height:0pt}.c39{font-size:11pt}.c32{font-weight:700}.c41{font-size:10pt}.c20{vertical-align:super}.c49{height:11pt}.c36{color:#000000}.c16{page-break-after:avoid}.c37{font-size:5pt}.c43{margin-left:36pt}.c25{font-size:9pt}.title{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#000000;font-size:10pt;padding-bottom:0pt;font-family:"Arial";line-height:1.0;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Tavis Ormandy, Project Zero
blog ·
projectzero.google
Using Kerberos for Authentication Relay Attacks
.post-body{ol.lst-kix_d25vxsk234hv-6{list-style-type:none}.lst-kix_wkcrlfh2qk3l-7>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-7}.lst-kix_i2wckd3yhfhe-0>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-0}ol.lst-kix_i2wckd3yhfhe-5.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-5 0}ol.lst-kix_d25vxsk234hv-5{list-style-type:none}ol.lst-kix_d25vxsk234hv-4{list-style-type:none}ol.lst-kix_jp16emg17n48-2.start{counter-reset:lst-ctn-kix_jp16emg17n48-2 0}ol.lst-kix_d25vxsk234hv-3{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-8{list-style-type:none}ol.lst-kix_d25vxsk234hv-2{list-style-type:none}ol.lst-kix_d25vxsk234hv-3.start{counter-reset:lst-ctn-kix_d25vxsk234hv-3 0}ol.lst-kix_d25vxsk234hv-1{list-style-type:none}ol.lst-kix_d25vxsk234hv-0{list-style-type:none}.lst-kix_d25vxsk234hv-4>li{counter-increment:lst-ctn-kix_d25vxsk234hv-4}.lst-kix_jp16emg17n48-8>li{counter-increment:lst-ctn-kix_jp16emg17n48-8}ul.lst-kix_fmj6vk2ylkib-0{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-1{list-style-type:none}ol.lst-kix_d25vxsk234hv-6.start{counter-reset:lst-ctn-kix_d25vxsk234hv-6 0}ol.lst-kix_i2wckd3yhfhe-4{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-8{list-style-type:none}.lst-kix_wkcrlfh2qk3l-8>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-8}ol.lst-kix_i2wckd3yhfhe-5{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-6{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-6{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-7{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-7{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-0{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-4{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-1{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-5{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-2{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-2{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-3{list-style-type:none}ul.lst-kix_fmj6vk2ylkib-3{list-style-type:none}.lst-kix_2yktnm17nyl7-2>li:before{content:"\0025a0 "}.lst-kix_2yktnm17nyl7-3>li:before{content:"\0025cf "}ul.lst-kix_2yktnm17nyl7-8{list-style-type:none}ul.lst-kix_2yktnm17nyl7-7{list-style-type:none}ul.lst-kix_2yktnm17nyl7-6{list-style-type:none}.lst-kix_d25vxsk234hv-2>li{counter-increment:lst-ctn-kix_d25vxsk234hv-2}.lst-kix_2yktnm17nyl7-1>li:before{content:"\0025cb "}.lst-kix_d25vxsk234hv-5>li{counter-increment:lst-ctn-kix_d25vxsk234hv-5}.lst-kix_jp16emg17n48-7>li{counter-increment:lst-ctn-kix_jp16emg17n48-7}ol.lst-kix_jp16emg17n48-8.start{counter-reset:lst-ctn-kix_jp16emg17n48-8 0}ol.lst-kix_d25vxsk234hv-0.start{counter-reset:lst-ctn-kix_d25vxsk234hv-0 0}.lst-kix_2yktnm17nyl7-0>li:before{content:"\0025cf "}.lst-kix_jp16emg17n48-4>li:before{content:"(" counter(lst-ctn-kix_jp16emg17n48-4,lower-latin) ") "}ol.lst-kix_wkcrlfh2qk3l-6.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-6 0}.lst-kix_jp16emg17n48-3>li:before{content:"(" counter(lst-ctn-kix_jp16emg17n48-3,decimal) ") "}.lst-kix_jp16emg17n48-5>li:before{content:"(" counter(lst-ctn-kix_jp16emg17n48-5,lower-roman) ") "}ul.lst-kix_2yktnm17nyl7-1{list-style-type:none}.lst-kix_jp16emg17n48-0>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-0,decimal) ") "}ul.lst-kix_2yktnm17nyl7-0{list-style-type:none}.lst-kix_jp16emg17n48-1>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-1,lower-latin) ") "}ul.lst-kix_2yktnm17nyl7-5{list-style-type:none}.lst-kix_jp16emg17n48-2>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-2,lower-roman) ") "}.lst-kix_wkcrlfh2qk3l-6>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-6}ul.lst-kix_2yktnm17nyl7-4{list-style-type:none}ol.lst-kix_i2wckd3yhfhe-0.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-0 0}ol.lst-kix_jp16emg17n48-5.start{counter-reset:lst-ctn-kix_jp16emg17n48-5 0}ul.lst-kix_2yktnm17nyl7-3{list-style-type:none}ol.lst-kix_d25vxsk234hv-8{list-style-type:none}ul.lst-kix_2yktnm17nyl7-2{list-style-type:none}ol.lst-kix_d25vxsk234hv-7{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-3.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-3 0}.lst-kix_jp16emg17n48-0>li{counter-increment:lst-ctn-kix_jp16emg17n48-0}.lst-kix_jp16emg17n48-7>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-7,lower-latin) ". "}ol.lst-kix_i2wckd3yhfhe-3.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-3 0}.lst-kix_jp16emg17n48-6>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-6,decimal) ". "}ol.lst-kix_i2wckd3yhfhe-7.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-7 0}.lst-kix_jp16emg17n48-6>li{counter-increment:lst-ctn-kix_jp16emg17n48-6}.lst-kix_wkcrlfh2qk3l-5>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-5}ol.lst-kix_jp16emg17n48-4.start{counter-reset:lst-ctn-kix_jp16emg17n48-4 0}.lst-kix_jp16emg17n48-8>li:before{content:"" counter(lst-ctn-kix_jp16emg17n48-8,lower-roman) ". "}ol.lst-kix_jp16emg17n48-3.start{counter-reset:lst-ctn-kix_jp16emg17n48-3 0}ol.lst-kix_wkcrlfh2qk3l-4.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-4 0}.lst-kix_wkcrlfh2qk3l-2>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-2}ol.lst-kix_i2wckd3yhfhe-2.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-2 0}.lst-kix_d25vxsk234hv-0>li{counter-increment:lst-ctn-kix_d25vxsk234hv-0}ol.lst-kix_d25vxsk234hv-5.start{counter-reset:lst-ctn-kix_d25vxsk234hv-5 0}ol.lst-kix_jp16emg17n48-8{list-style-type:none}.lst-kix_d25vxsk234hv-6>li{counter-increment:lst-ctn-kix_d25vxsk234hv-6}ol.lst-kix_jp16emg17n48-7{list-style-type:none}.lst-kix_i2wckd3yhfhe-1>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-1}ol.lst-kix_i2wckd3yhfhe-8.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-8 0}.lst-kix_i2wckd3yhfhe-4>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-4}ol.lst-kix_jp16emg17n48-4{list-style-type:none}ol.lst-kix_jp16emg17n48-3{list-style-type:none}ol.lst-kix_jp16emg17n48-6{list-style-type:none}ol.lst-kix_jp16emg17n48-5{list-style-type:none}ol.lst-kix_jp16emg17n48-0{list-style-type:none}ol.lst-kix_jp16emg17n48-2{list-style-type:none}.lst-kix_d25vxsk234hv-3>li{counter-increment:lst-ctn-kix_d25vxsk234hv-3}.lst-kix_i2wckd3yhfhe-7>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-7}ol.lst-kix_jp16emg17n48-1{list-style-type:none}.lst-kix_fmj6vk2ylkib-1>li:before{content:"\0025cb "}.lst-kix_wkcrlfh2qk3l-1>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-1}.lst-kix_fmj6vk2ylkib-0>li:before{content:"\0025cf "}.lst-kix_fmj6vk2ylkib-2>li:before{content:"\0025a0 "}.lst-kix_fmj6vk2ylkib-3>li:before{content:"\0025cf "}ol.lst-kix_wkcrlfh2qk3l-8.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-8 0}.lst-kix_i2wckd3yhfhe-1>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-1,lower-latin) ") "}.lst-kix_jp16emg17n48-2>li{counter-increment:lst-ctn-kix_jp16emg17n48-2}.lst-kix_i2wckd3yhfhe-2>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-2,lower-roman) ") "}.lst-kix_i2wckd3yhfhe-6>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-6}.lst-kix_i2wckd3yhfhe-4>li:before{content:"(" counter(lst-ctn-kix_i2wckd3yhfhe-4,lower-latin) ") "}.lst-kix_wkcrlfh2qk3l-7>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-7,lower-latin) ". "}.lst-kix_wkcrlfh2qk3l-8>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-8,lower-roman) ". "}.lst-kix_i2wckd3yhfhe-3>li:before{content:"(" counter(lst-ctn-kix_i2wckd3yhfhe-3,decimal) ") "}.lst-kix_i2wckd3yhfhe-5>li:before{content:"(" counter(lst-ctn-kix_i2wckd3yhfhe-5,lower-roman) ") "}.lst-kix_jp16emg17n48-3>li{counter-increment:lst-ctn-kix_jp16emg17n48-3}.lst-kix_i2wckd3yhfhe-5>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-5}ol.lst-kix_jp16emg17n48-6.start{counter-reset:lst-ctn-kix_jp16emg17n48-6 0}.lst-kix_i2wckd3yhfhe-8>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-8,lower-roman) ". "}.lst-kix_d25vxsk234hv-8>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-8,lower-roman) ". "}ol.lst-kix_wkcrlfh2qk3l-5.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-5 0}ol.lst-kix_i2wckd3yhfhe-1.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-1 0}.lst-kix_i2wckd3yhfhe-7>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-7,lower-latin) ". "}.lst-kix_i2wckd3yhfhe-6>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-6,decimal) ". "}.lst-kix_jp16emg17n48-1>li{counter-increment:lst-ctn-kix_jp16emg17n48-1}.lst-kix_d25vxsk234hv-4>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-4,lower-latin) ". "}.lst-kix_wkcrlfh2qk3l-0>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-0,decimal) ". "}.lst-kix_d25vxsk234hv-8>li{counter-increment:lst-ctn-kix_d25vxsk234hv-8}.lst-kix_jp16emg17n48-4>li{counter-increment:lst-ctn-kix_jp16emg17n48-4}.lst-kix_d25vxsk234hv-3>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-3,decimal) ". "}.lst-kix_d25vxsk234hv-5>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-5,lower-roman) ". "}ol.lst-kix_i2wckd3yhfhe-6.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-6 0}.lst-kix_wkcrlfh2qk3l-1>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-1,lower-latin) ". "}ol.lst-kix_wkcrlfh2qk3l-2.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-2 0}.lst-kix_d25vxsk234hv-7>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-7,lower-latin) ". "}ol.lst-kix_d25vxsk234hv-4.start{counter-reset:lst-ctn-kix_d25vxsk234hv-4 0}.lst-kix_d25vxsk234hv-6>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-6,decimal) ". "}.lst-kix_wkcrlfh2qk3l-6>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-6,decimal) ". "}.lst-kix_fmj6vk2ylkib-8>li:before{content:"\0025a0 "}.lst-kix_fmj6vk2ylkib-7>li:before{content:"\0025cb "}.lst-kix_wkcrlfh2qk3l-5>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-5,lower-roman) ". "}.lst-kix_wkcrlfh2qk3l-0>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-0}.lst-kix_i2wckd3yhfhe-0>li:before{content:"" counter(lst-ctn-kix_i2wckd3yhfhe-0,decimal) ") "}.lst-kix_fmj6vk2ylkib-5>li:before{content:"\0025a0 "}.lst-kix_d25vxsk234hv-0>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-0,decimal) ". "}.lst-kix_wkcrlfh2qk3l-3>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-3,decimal) ". "}.lst-kix_wkcrlfh2qk3l-4>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-4,lower-latin) ". "}ol.lst-kix_d25vxsk234hv-7.start{counter-reset:lst-ctn-kix_d25vxsk234hv-7 0}.lst-kix_wkcrlfh2qk3l-3>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-3}.lst-kix_fmj6vk2ylkib-4>li:before{content:"\0025cb "}.lst-kix_fmj6vk2ylkib-6>li:before{content:"\0025cf "}.lst-kix_d25vxsk234hv-1>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-1,lower-latin) ". "}.lst-kix_d25vxsk234hv-2>li:before{content:"" counter(lst-ctn-kix_d25vxsk234hv-2,lower-roman) ". "}.lst-kix_wkcrlfh2qk3l-2>li:before{content:"" counter(lst-ctn-kix_wkcrlfh2qk3l-2,lower-roman) ". "}.lst-kix_wkcrlfh2qk3l-4>li{counter-increment:lst-ctn-kix_wkcrlfh2qk3l-4}.lst-kix_d25vxsk234hv-1>li{counter-increment:lst-ctn-kix_d25vxsk234hv-1}ol.lst-kix_d25vxsk234hv-8.start{counter-reset:lst-ctn-kix_d25vxsk234hv-8 0}ol.lst-kix_d25vxsk234hv-1.start{counter-reset:lst-ctn-kix_d25vxsk234hv-1 0}.lst-kix_d25vxsk234hv-7>li{counter-increment:lst-ctn-kix_d25vxsk234hv-7}.lst-kix_i2wckd3yhfhe-3>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-3}.lst-kix_jp16emg17n48-5>li{counter-increment:lst-ctn-kix_jp16emg17n48-5}ol.lst-kix_jp16emg17n48-7.start{counter-reset:lst-ctn-kix_jp16emg17n48-7 0}ol.lst-kix_wkcrlfh2qk3l-4{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-0.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-0 0}ol.lst-kix_wkcrlfh2qk3l-3{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-2{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-1{list-style-type:none}.lst-kix_i2wckd3yhfhe-8>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-8}ol.lst-kix_wkcrlfh2qk3l-0{list-style-type:none}ol.lst-kix_jp16emg17n48-1.start{counter-reset:lst-ctn-kix_jp16emg17n48-1 0}ol.lst-kix_i2wckd3yhfhe-4.start{counter-reset:lst-ctn-kix_i2wckd3yhfhe-4 0}ol.lst-kix_wkcrlfh2qk3l-8{list-style-type:none}.lst-kix_i2wckd3yhfhe-2>li{counter-increment:lst-ctn-kix_i2wckd3yhfhe-2}ol.lst-kix_wkcrlfh2qk3l-7{list-style-type:none}.lst-kix_2yktnm17nyl7-4>li:before{content:"\0025cb "}ol.lst-kix_wkcrlfh2qk3l-6{list-style-type:none}ol.lst-kix_wkcrlfh2qk3l-5{list-style-type:none}ol.lst-kix_d25vxsk234hv-2.start{counter-reset:lst-ctn-kix_d25vxsk234hv-2 0}.lst-kix_2yktnm17nyl7-5>li:before{content:"\0025a0 "}.lst-kix_2yktnm17nyl7-6>li:before{content:"\0025cf "}.lst-kix_2yktnm17nyl7-7>li:before{content:"\0025cb "}ol.lst-kix_wkcrlfh2qk3l-7.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-7 0}.lst-kix_2yktnm17nyl7-8>li:before{content:"\0025a0 "}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ol.lst-kix_wkcrlfh2qk3l-1.start{counter-reset:lst-ctn-kix_wkcrlfh2qk3l-1 0}ol.lst-kix_jp16emg17n48-0.start{counter-reset:lst-ctn-kix_jp16emg17n48-0 0}ol{margin:0;padding:0}table td,table th{padding:0}.c29{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:49.5pt;border-top-color:#000000;border-bottom-style:solid}.c10{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:66.8pt;border-top-color:#000000;border-bottom-style:solid}.c11{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c22{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:87pt;border-top-color:#000000;border-bottom-style:solid}.c30{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:81pt;border-top-color:#000000;border-bottom-style:solid}.c15{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:164.2pt;border-top-color:#000000;border-bottom-style:solid}.c3{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c26{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c31{color:#434343;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:14pt;font-family:"Arial";font-style:normal}.c32{padding-top:16pt;padding-bottom:4pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c0{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c39{-webkit-text-decoration-skip:none;color:#000000;text-decoration:line-through;vertical-align:baseline;text-decoration-skip-ink:none;font-style:normal}.c38{color:#000000;text-decoration:none;vertical-align:super;font-style:normal}.c21{border-spacing:0;border-collapse:collapse;margin-right:auto}.c7{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:left}.c6{color:#000000;text-decoration:none;vertical-align:baseline;font-style:normal}.c8{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c1{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c25{font-weight:400;font-size:11pt;font-family:"Arial"}.c37{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c19{font-weight:400;font-size:16pt;font-family:"Arial"}.c2{font-size:10pt;font-family:"Courier New";font-weight:400}.c12{font-weight:400;font-size:11pt;font-family:"Courier New"}.c40{font-weight:400;font-size:10pt;font-family:"Arial"}.c14{color:#000000;text-decoration:none;vertical-align:baseline}.c42{font-family:"Courier New";font-weight:400}.c16{border:1px solid black;margin:5px}.c18{margin-left:36pt;padding-left:0pt}.c5{color:inherit;text-decoration:inherit}.c24{padding:0;margin:0}.c28{background-color:#ffff00}.c33{background-color:#cccccc}.c9{height:11pt}.c17{color:#696969}.c34{color:#000080}.c4{font-style:italic}.c13{color:#0000ff}.c35{color:#8a2be2}.c36{color:#a31515}.c23{color:#a82d00}.c20{height:0pt}.c41{vertical-align:super}.c27{color:#8b0000}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}}
blog ·
projectzero.google
Windows Exploitation Tricks: Relaying DCOM Authentication
.post-body{.lst-kix_21eii7u3d36d-6>li:before{content:"" counter(lst-ctn-kix_21eii7u3d36d-6,decimal) ". "}.lst-kix_4h5ag0d3tyrp-4>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-4}ol.lst-kix_21eii7u3d36d-8{list-style-type:none}ol.lst-kix_21eii7u3d36d-7{list-style-type:none}ol.lst-kix_21eii7u3d36d-0.start{counter-reset:lst-ctn-kix_21eii7u3d36d-0 0}ol.lst-kix_21eii7u3d36d-6{list-style-type:none}ol.lst-kix_21eii7u3d36d-5{list-style-type:none}.lst-kix_21eii7u3d36d-3>li:before{content:"(" counter(lst-ctn-kix_21eii7u3d36d-3,decimal) ") "}ol.lst-kix_21eii7u3d36d-4{list-style-type:none}.lst-kix_21eii7u3d36d-7>li:before{content:"" counter(lst-ctn-kix_21eii7u3d36d-7,lower-latin) ". "}ol.lst-kix_21eii7u3d36d-3{list-style-type:none}ol.lst-kix_4h5ag0d3tyrp-6.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-6 0}.lst-kix_21eii7u3d36d-2>li:before{content:"" counter(lst-ctn-kix_21eii7u3d36d-2,lower-roman) ") "}ol.lst-kix_21eii7u3d36d-2{list-style-type:none}ol.lst-kix_21eii7u3d36d-1{list-style-type:none}ol.lst-kix_21eii7u3d36d-7.start{counter-reset:lst-ctn-kix_21eii7u3d36d-7 0}ol.lst-kix_21eii7u3d36d-0{list-style-type:none}.lst-kix_21eii7u3d36d-0>li:before{content:"" counter(lst-ctn-kix_21eii7u3d36d-0,decimal) ") "}ol.lst-kix_21eii7u3d36d-3.start{counter-reset:lst-ctn-kix_21eii7u3d36d-3 0}.lst-kix_21eii7u3d36d-8>li:before{content:"" counter(lst-ctn-kix_21eii7u3d36d-8,lower-roman) ". "}.lst-kix_21eii7u3d36d-1>li:before{content:"" counter(lst-ctn-kix_21eii7u3d36d-1,lower-latin) ") "}.lst-kix_21eii7u3d36d-3>li{counter-increment:lst-ctn-kix_21eii7u3d36d-3}.lst-kix_4h5ag0d3tyrp-5>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-5}ol.lst-kix_21eii7u3d36d-6.start{counter-reset:lst-ctn-kix_21eii7u3d36d-6 0}ol.lst-kix_4h5ag0d3tyrp-3.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-3 0}ol.lst-kix_4h5ag0d3tyrp-7.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-7 0}.lst-kix_21eii7u3d36d-2>li{counter-increment:lst-ctn-kix_21eii7u3d36d-2}.lst-kix_21eii7u3d36d-5>li{counter-increment:lst-ctn-kix_21eii7u3d36d-5}.lst-kix_21eii7u3d36d-8>li{counter-increment:lst-ctn-kix_21eii7u3d36d-8}ol.lst-kix_4h5ag0d3tyrp-0.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-0 0}ol.lst-kix_21eii7u3d36d-8.start{counter-reset:lst-ctn-kix_21eii7u3d36d-8 0}ol.lst-kix_4h5ag0d3tyrp-4.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-4 0}ol.lst-kix_21eii7u3d36d-2.start{counter-reset:lst-ctn-kix_21eii7u3d36d-2 0}.lst-kix_4h5ag0d3tyrp-0>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-0}.lst-kix_21eii7u3d36d-4>li:before{content:"(" counter(lst-ctn-kix_21eii7u3d36d-4,lower-latin) ") "}.lst-kix_4h5ag0d3tyrp-6>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-6}.lst-kix_21eii7u3d36d-5>li:before{content:"(" counter(lst-ctn-kix_21eii7u3d36d-5,lower-roman) ") "}.lst-kix_4h5ag0d3tyrp-3>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-3}ol.lst-kix_4h5ag0d3tyrp-6{list-style-type:none}ol.lst-kix_4h5ag0d3tyrp-7{list-style-type:none}ol.lst-kix_21eii7u3d36d-5.start{counter-reset:lst-ctn-kix_21eii7u3d36d-5 0}ol.lst-kix_4h5ag0d3tyrp-4{list-style-type:none}ol.lst-kix_4h5ag0d3tyrp-1.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-1 0}ol.lst-kix_4h5ag0d3tyrp-5{list-style-type:none}.lst-kix_4h5ag0d3tyrp-7>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-7,lower-latin) ". "}.lst-kix_21eii7u3d36d-6>li{counter-increment:lst-ctn-kix_21eii7u3d36d-6}ol.lst-kix_4h5ag0d3tyrp-8.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-8 0}.lst-kix_4h5ag0d3tyrp-1>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-1}ol.lst-kix_4h5ag0d3tyrp-8{list-style-type:none}.lst-kix_4h5ag0d3tyrp-4>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-4,lower-latin) ". "}.lst-kix_4h5ag0d3tyrp-8>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-8,lower-roman) ". "}.lst-kix_21eii7u3d36d-0>li{counter-increment:lst-ctn-kix_21eii7u3d36d-0}.lst-kix_4h5ag0d3tyrp-3>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-3,decimal) ". "}ol.lst-kix_4h5ag0d3tyrp-2{list-style-type:none}ol.lst-kix_4h5ag0d3tyrp-3{list-style-type:none}ol.lst-kix_4h5ag0d3tyrp-0{list-style-type:none}ol.lst-kix_4h5ag0d3tyrp-1{list-style-type:none}.lst-kix_4h5ag0d3tyrp-2>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-2,lower-roman) ". "}.lst-kix_4h5ag0d3tyrp-7>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-7}ol.lst-kix_21eii7u3d36d-1.start{counter-reset:lst-ctn-kix_21eii7u3d36d-1 0}.lst-kix_4h5ag0d3tyrp-5>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-5,lower-roman) ". "}.lst-kix_4h5ag0d3tyrp-8>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-8}.lst-kix_4h5ag0d3tyrp-6>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-6,decimal) ". "}ol.lst-kix_21eii7u3d36d-4.start{counter-reset:lst-ctn-kix_21eii7u3d36d-4 0}.lst-kix_4h5ag0d3tyrp-2>li{counter-increment:lst-ctn-kix_4h5ag0d3tyrp-2}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ol.lst-kix_4h5ag0d3tyrp-5.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-5 0}.lst-kix_21eii7u3d36d-4>li{counter-increment:lst-ctn-kix_21eii7u3d36d-4}.lst-kix_21eii7u3d36d-7>li{counter-increment:lst-ctn-kix_21eii7u3d36d-7}.lst-kix_4h5ag0d3tyrp-1>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-1,lower-latin) ". "}.lst-kix_21eii7u3d36d-1>li{counter-increment:lst-ctn-kix_21eii7u3d36d-1}.lst-kix_4h5ag0d3tyrp-0>li:before{content:"" counter(lst-ctn-kix_4h5ag0d3tyrp-0,decimal) ". "}ol.lst-kix_4h5ag0d3tyrp-2.start{counter-reset:lst-ctn-kix_4h5ag0d3tyrp-2 0}ol{margin:0;padding:0}table td,table th{padding:0}.c31{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c9{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c23{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c0{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c6{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:10pt;font-family:"Courier New";font-style:normal}.c5{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c10{background-color:#ffffff;font-size:10pt;font-family:"Courier New";color:#8000ff;font-weight:400}.c3{background-color:#ffffff;font-size:10pt;font-family:"Courier New";color:#000080;font-weight:700}.c20{border-spacing:0;border-collapse:collapse;margin-right:auto}.c16{background-color:#ffffff;font-size:10pt;font-family:"Courier New";font-weight:700}.c1{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c11{background-color:#ffffff;font-size:10pt;font-family:"Courier New";font-weight:400}.c25{color:#000000;font-weight:400;font-size:16pt;font-family:"Arial"}.c22{color:#000000;font-weight:400;font-size:11pt;font-family:"Courier New"}.c2{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c8{font-size:10pt;font-family:"Courier New";color:#a82d00;font-weight:400}.c7{font-size:10pt;font-family:"Courier New";color:#696969;font-weight:400}.c12{font-size:10pt;font-family:"Courier New";font-weight:400}.c17{text-decoration:none;vertical-align:baseline;font-style:normal}.c29{padding:0;margin:0}.c34{margin-left:36pt;padding-left:0pt}.c35{max-width:468pt;padding:72pt 72pt 72pt 72pt}.c21{color:inherit;text-decoration:inherit}.c14{color:#8b0000}.c13{color:#0000ff}.c19{height:11pt}.c15{color:#800000}.c4{font-style:italic}.c18{color:#800080}.c24{color:#006161}.c33{background-color:#ffffff}.c32{color:#000080}.c27{color:#a31515}.c30{color:#00008b}.c26{height:0pt}.c28{color:#8a2be2}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by James Forshaw, Project Zero
blog ·
projectzero.google
How a simple Linux kernel memory corruption bug can lead to complete system compromise
.post-body{ .markdown-body pre { padding: 16px; overflow: auto; font-size: 85%; line-height: 1.45; background-color: #e2e2e2; border-radius: 3px; font-family: Consolas, monospace; } } An analysis of current and potential kernel security mitigations Posted by Jann Horn, Project Zero
blog ·
projectzero.google
Fuzzing Closed-Source JavaScript Engines with Coverage Feedback
.post-body{ul.lst-kix_do14k59gl4sr-0{list-style-type:none}ul.lst-kix_do14k59gl4sr-1{list-style-type:none}ul.lst-kix_do14k59gl4sr-2{list-style-type:none}ul.lst-kix_do14k59gl4sr-3{list-style-type:none}.lst-kix_u927wi79aeqb-0>li:before{content:"- "}.lst-kix_u927wi79aeqb-1>li:before{content:"- "}.lst-kix_u927wi79aeqb-2>li:before{content:"- "}.lst-kix_do14k59gl4sr-2>li:before{content:"- "}ul.lst-kix_do14k59gl4sr-4{list-style-type:none}.lst-kix_u927wi79aeqb-5>li:before{content:"- "}ul.lst-kix_do14k59gl4sr-5{list-style-type:none}.lst-kix_do14k59gl4sr-1>li:before{content:"- "}ul.lst-kix_do14k59gl4sr-6{list-style-type:none}ul.lst-kix_do14k59gl4sr-7{list-style-type:none}.lst-kix_do14k59gl4sr-0>li:before{content:"- "}ul.lst-kix_do14k59gl4sr-8{list-style-type:none}.lst-kix_u927wi79aeqb-3>li:before{content:"- "}.lst-kix_u927wi79aeqb-4>li:before{content:"- "}.lst-kix_u927wi79aeqb-6>li:before{content:"- "}.lst-kix_do14k59gl4sr-3>li:before{content:"- "}.lst-kix_do14k59gl4sr-4>li:before{content:"- "}.lst-kix_u927wi79aeqb-7>li:before{content:"- "}.lst-kix_u927wi79aeqb-8>li:before{content:"- "}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ul.lst-kix_u927wi79aeqb-0{list-style-type:none}.lst-kix_do14k59gl4sr-6>li:before{content:"- "}ul.lst-kix_u927wi79aeqb-2{list-style-type:none}.lst-kix_do14k59gl4sr-5>li:before{content:"- "}.lst-kix_do14k59gl4sr-7>li:before{content:"- "}ul.lst-kix_u927wi79aeqb-1{list-style-type:none}ul.lst-kix_u927wi79aeqb-4{list-style-type:none}ul.lst-kix_u927wi79aeqb-3{list-style-type:none}ul.lst-kix_u927wi79aeqb-6{list-style-type:none}ul.lst-kix_u927wi79aeqb-5{list-style-type:none}ul.lst-kix_u927wi79aeqb-8{list-style-type:none}ul.lst-kix_u927wi79aeqb-7{list-style-type:none}.lst-kix_do14k59gl4sr-8>li:before{content:"- "}ol{margin:0;padding:0}table td,table th{padding:0}.c0{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c9{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:20pt;font-family:"Arial";font-style:normal}.c2{padding-top:20pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c10{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:italic}.c12{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:center}.c1{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c7{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt;font-style:normal}.c5{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c14{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c6{font-weight:400;font-family:"Courier New"}.c3{margin-left:36pt;padding-left:0pt}.c13{padding:0;margin:0}.c8{color:inherit;text-decoration:inherit}.c11{font-style:italic}.c4{height:11pt}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Ivan Fratric, Project Zero
blog ·
projectzero.google
Understanding Network Access in Windows AppContainers
.post-body{ul.lst-kix_w3t1hchiy4w5-6{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-1{list-style-type:none}ul.lst-kix_w3t1hchiy4w5-5{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-0{list-style-type:none}ul.lst-kix_w3t1hchiy4w5-4{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-3{list-style-type:none}ul.lst-kix_w3t1hchiy4w5-3{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-2{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-5{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-4{list-style-type:none}ul.lst-kix_w3t1hchiy4w5-8{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-7{list-style-type:none}ul.lst-kix_w3t1hchiy4w5-7{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-6{list-style-type:none}ul.lst-kix_a73fbzj8zqo2-8{list-style-type:none}ul.lst-kix_w3t1hchiy4w5-2{list-style-type:none}ul.lst-kix_w3t1hchiy4w5-1{list-style-type:none}ul.lst-kix_w3t1hchiy4w5-0{list-style-type:none}.lst-kix_9fia5rt9e6y-4>li:before{content:"\0025cb "}.lst-kix_9fia5rt9e6y-6>li:before{content:"\0025cf "}.lst-kix_w3t1hchiy4w5-2>li:before{content:"\0025a0 "}.lst-kix_9fia5rt9e6y-3>li:before{content:"\0025cf "}.lst-kix_9fia5rt9e6y-7>li:before{content:"\0025cb "}.lst-kix_w3t1hchiy4w5-3>li:before{content:"\0025cf "}.lst-kix_a73fbzj8zqo2-6>li:before{content:"\0025cf "}.lst-kix_9fia5rt9e6y-0>li:before{content:"\0025cf "}.lst-kix_9fia5rt9e6y-2>li:before{content:"\0025a0 "}.lst-kix_9fia5rt9e6y-8>li:before{content:"\0025a0 "}.lst-kix_w3t1hchiy4w5-4>li:before{content:"\0025cb "}.lst-kix_a73fbzj8zqo2-5>li:before{content:"\0025a0 "}.lst-kix_9fia5rt9e6y-1>li:before{content:"\0025cb "}.lst-kix_w3t1hchiy4w5-5>li:before{content:"\0025a0 "}.lst-kix_w3t1hchiy4w5-7>li:before{content:"\0025cb "}.lst-kix_a73fbzj8zqo2-2>li:before{content:"\0025a0 "}.lst-kix_a73fbzj8zqo2-4>li:before{content:"\0025cb "}.lst-kix_w3t1hchiy4w5-6>li:before{content:"\0025cf "}.lst-kix_a73fbzj8zqo2-3>li:before{content:"\0025cf "}.lst-kix_a73fbzj8zqo2-0>li:before{content:"\0025cf "}.lst-kix_w3t1hchiy4w5-8>li:before{content:"\0025a0 "}.lst-kix_a73fbzj8zqo2-1>li:before{content:"\0025cb "}.lst-kix_9fia5rt9e6y-5>li:before{content:"\0025a0 "}ul.lst-kix_uwx5zr9ju08v-8{list-style-type:none}.lst-kix_a73fbzj8zqo2-7>li:before{content:"\0025cb "}ul.lst-kix_uwx5zr9ju08v-3{list-style-type:none}ul.lst-kix_uwx5zr9ju08v-2{list-style-type:none}ul.lst-kix_uwx5zr9ju08v-1{list-style-type:none}ul.lst-kix_uwx5zr9ju08v-0{list-style-type:none}.lst-kix_w3t1hchiy4w5-1>li:before{content:"\0025cb "}.lst-kix_a73fbzj8zqo2-8>li:before{content:"\0025a0 "}ul.lst-kix_uwx5zr9ju08v-7{list-style-type:none}ul.lst-kix_uwx5zr9ju08v-6{list-style-type:none}ul.lst-kix_uwx5zr9ju08v-5{list-style-type:none}ul.lst-kix_uwx5zr9ju08v-4{list-style-type:none}.lst-kix_w3t1hchiy4w5-0>li:before{content:"\0025cf "}.lst-kix_uwx5zr9ju08v-7>li:before{content:"\0025cb "}.lst-kix_uwx5zr9ju08v-6>li:before{content:"\0025cf "}.lst-kix_uwx5zr9ju08v-8>li:before{content:"\0025a0 "}.lst-kix_uwx5zr9ju08v-5>li:before{content:"\0025a0 "}ul.lst-kix_9fia5rt9e6y-0{list-style-type:none}ul.lst-kix_9fia5rt9e6y-1{list-style-type:none}ul.lst-kix_9fia5rt9e6y-2{list-style-type:none}ul.lst-kix_9fia5rt9e6y-3{list-style-type:none}ul.lst-kix_9fia5rt9e6y-4{list-style-type:none}ul.lst-kix_9fia5rt9e6y-5{list-style-type:none}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ul.lst-kix_9fia5rt9e6y-6{list-style-type:none}ul.lst-kix_9fia5rt9e6y-7{list-style-type:none}ul.lst-kix_9fia5rt9e6y-8{list-style-type:none}.lst-kix_uwx5zr9ju08v-0>li:before{content:"\0025cf "}.lst-kix_uwx5zr9ju08v-1>li:before{content:"\0025cb "}.lst-kix_uwx5zr9ju08v-3>li:before{content:"\0025cf "}.lst-kix_uwx5zr9ju08v-2>li:before{content:"\0025a0 "}.lst-kix_uwx5zr9ju08v-4>li:before{content:"\0025cb "}ol{margin:0;padding:0}table td,table th{padding:0}.c19{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;background-color:#012356;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c40{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c6{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:249.8pt;border-top-color:#000000;border-bottom-style:solid}.c30{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:247.5pt;border-top-color:#000000;border-bottom-style:solid}.c15{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:218.2pt;border-top-color:#000000;border-bottom-style:solid}.c28{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:220.5pt;border-top-color:#000000;border-bottom-style:solid}.c9{background-color:#ffffff;color:#171717;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:10.5pt;font-family:"Arial";font-style:normal}.c35{background-color:#ffe599;color:#171717;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c39{background-color:#d9ead3;color:#171717;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c24{background-color:#f9cb9c;color:#171717;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c31{background-color:#f6b26b;color:#171717;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c3{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c20{color:#f4cccc;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c5{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:10pt;font-family:"Arial";font-style:normal}.c33{padding-top:16pt;padding-bottom:4pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c26{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c25{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:16pt;font-family:"Arial";font-style:normal}.c2{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c8{color:#ffff00;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c16{color:#434343;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:14pt;font-family:"Arial";font-style:normal}.c18{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c0{color:#efefef;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c34{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial"}.c22{color:#000000;font-weight:700;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial"}.c4{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c10{border-spacing:0;border-collapse:collapse;margin-right:auto}.c13{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c1{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c38{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c32{background-color:#ffffff;font-size:10.5pt;color:#171717}.c14{font-family:"Courier New";color:#efefef;font-weight:400}.c23{font-family:"Courier New";color:#ffff00;font-weight:400}.c27{border:1px solid black;margin:5px}.c17{padding:0;margin:0}.c11{color:inherit;text-decoration:inherit}.c29{margin-left:36pt;padding-left:0pt}.c37{background-color:#ff9900}.c12{height:0pt}.c36{background-color:#ff0000}.c21{height:11pt}.c7{font-style:italic}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by James Forshaw, Project ZeroRecently I've been delving into the inner workings of the Windows Firewall. This is interesting to me as it's used to enforce various restrictions such as whether AppContainer sandboxed applications can access the network. Being able to bypass network restrictions in AppContainer sandboxes is interesting as it expands the attack surface available to the application, such as being able to access services on localhost, as well as granting access to intranet resources in an Enterprise.