In this presentation, NetSPI’s Jake Karnes explains the inner workings of CVE-2020-17049: The Kerberos Bronze Bit Attack. Jake discovered this vulnerability and responsibly disclosed it to Microsoft who provided patches in November and December of 2020. Once the patches became available, Jake shared the exploit which allows an attacker to bypass security features and escalate privileges within an Active Directory domain.
The presentation provides an introduction to the Kerberos protocol and Microsoft’s use of Kerberos Delegation. If a better understanding of Kerberos has been on your “to-do” list, here’s a great opportunity to dive in and learn more. After covering Kerberos, the vulnerability and its exploit are explained, including its potential impact in a compromised environment. The presentation also includes a demonstration of the exploit in action. In the demonstration, we see how an attacker can escalate privileges from a compromised user account to gain access to additional sensitive systems.