Breaking Kerberos' RC4 Cipher and Spoofing Windows PACs
summary
Finds a pre-hash bug in Kerberos RC4-HMAC that lets MD5 collisions produce matching PAC signatures, then turns it into a working exploit: uses a chosen-prefix MD5 collision computed with a modified hashclash tool (rejecting UTF-16 surrogates), injects the collision bytes into a computer account’s logonPath attribute, obtains a valid server signature and swaps suffixes to create a forged PAC that bypasses constrained delegation checks and impersonates high‑privilege accounts; Microsoft issues defaults to disable RC4 and a phased PAC fix.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:44What is Kerberos?
- 3:27Default supported encryption types
- 5:41Known weaknesses
- 11:10Computing MD5 collisions
- 13:20How to exploit?
- 15:50A protocol using the broken CHKSUM
- 16:13PAC authorization data
- 21:07A small HashClash hack
- 23:54Step 2: compute collision
- 24:56Step 3: store collision bytes in scriptPath request PAC again
- 27:22The problem with MAC-over-MAC
- 33:37A successful (but limited) exploit
- 36:29The patches
- 39:33Black Hat Sound Bytes
related talks
44mCrippling HTTPs With Unholy PAC
50mWatching The Watchdog: Protecting Kerberos Authentication With Network Monitoring
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
47mFinding a Needle in an Encrypted Haystack
58mHacking in 2016 - How is our systems broken?
49mThe Remote Malicious Butler Did It!
45mThe Code Behind The Vulnerability
40mExploiting Windows Hello for Business