Infiltr8: Red-Book
Active Directory PentestingMovementKerberos

Principal Confusion

Making the KDC issue tickets for the wrong principal

Theory

Kerberos identifies accounts by attributes that are not always immutable or unique. If an attacker can change one of them, the KDC can be persuaded to issue a ticket describing a different principal from the one that authenticated, and the resulting ticket is legitimately signed.

These attacks turn on the relationship between an account's sAMAccountName, its servicePrincipalName and the sname in a ticket request, and on how the KDC resolves a principal when those disagree.

On this page