CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass

CVSS Score: 9.8 (Critical)
Status: Active exploitation in the wild
Disclosure: Microsoft August 2025 Patch Tuesday (Zero-Day)

Overview

CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protocol implementation. An unauthenticated attacker can exploit this flaw to bypass Kerberos authentication entirely, impersonating any domain user — including domain administrators — without possessing valid credentials or any cryptographic material.

Microsoft assigned this vulnerability a CVSS 9.8 (Critical) rating due to its low attack complexity, no required privileges, no user interaction, and the potential for complete compromise of domain-joined systems.

Technical Details

Root Cause

The vulnerability resides in the Kerberos Key Distribution Center (KDC) service (kdsvc.dll) on Windows domain controllers. Specifically, a validation logic error in the Privilege Attribute Certificate (PAC) verification routine allows an attacker to craft an AS-REQ or TGS-REQ message that bypasses the standard authentication checks.

Affected Component

• Component: Kerberos Key Distribution Center (KDC)
• Binary: kdsvc.dll
• Protocol: Kerberos v5 (RFC 4120)
• Vulnerability Type: Authentication Bypass via PAC Validation Logic Flaw

Attack Vector

The KDC fails to properly validate the pac-signature-data field in the PAC structure when specific flags are set in the Kerberos message body. By sending a specially crafted AS-REQ with a manipulated PA-PAC-REQUEST padata type and a forged authorization data entry, the attacker tricks the KDC into issuing a Ticket-Granting Ticket (TGT) for any user principal name (UPN) without requiring the corresponding long-term key.

The attack bypasses pre-authentication (the REQUIRES_PRE_AUTH flag is effectively ignored) and skips PAC verification entirely, allowing the generated ticket to contain arbitrary group memberships (e.g., Domain Admins, Enterprise Admins).

Impact

• Complete Authentication Bypass: No credentials required to obtain a valid Kerberos TGT
• Privilege Escalation: Ability to impersonate any domain user, including domain administrators
• Lateral Movement: Once a TGT is obtained, an attacker can request service tickets for any resource
• Persistence: Golden/silver ticket-style attacks become trivial
• Full Domain Compromise: An attacker effectively gains Domain Admin privileges from an unauthenticated position

Affected Versions

All supported versions of Windows Server are affected prior to the August 2025 security update:

Note: Windows client versions (Windows 10, Windows 11) are not affected as they do not run the KDC service.

Reproduction Steps

Prerequisites

1. A Windows domain controller running an unpatched Windows Server version (see affected versions above)
2. Network access to the domain controller (port 88/TCP and/or 88/UDP must be open)
3. Python 3.8+ with the impacket library installed
4. This PoC script (exploit.py)

Step 1: Install Dependencies

pip install impacket pycryptodome

Or using the provided requirements.txt:

pip install -r requirements.txt

Step 2: Identify a Target Domain Controller

Use Nmap to discover Kerberos services:

nmap -sU -p 88 --script krb5-enum-users <target-ip>

Or use the built-in Kerberos scanning:

python exploit.py --scan <target-ip>

Step 3: Enumerate Domain Users (Optional)

If you do not know domain users, enumerate them via Kerberos AS-REP roasting or LDAP:

python exploit.py --enum <target-ip> <domain>

Step 4: Execute the Exploit

Generate a forged TGT for a target user:

python exploit.py --dc-ip <dc-ip> --domain <domain> --target-user <username>

Example:

python exploit.py --dc-ip 192.168.1.10 --domain corp.local --target-user Administrator

Step 5: Verify the Ticket

The exploit outputs a Kirbi-formatted ticket file. Use Impacket tools to verify:

# Export the ticket
set KRB5CCNAME=ticket.kirbi

# Use the ticket to access a resource
python examples/secretsdump.py -k -no-pass <domain>/Administrator@<target>

Step 6: Post-Exploitation

Once a valid TGT is obtained, you can:

• Dump hashes: secretsdump.py -k -no-pass domain/Administrator@<dc>
• PTT (Pass-the-Ticket): mimikatz "kerberos::ptt ticket.kirbi"
• Golden Ticket: The same technique can generate tickets for any user
• Silver Ticket: Request service tickets for specific services (CIFS, HTTP, LDAP)

PoC (Proof of Concept)

The accompanying exploit.py implements the following attack flow:

1. AS-REQ Construction: Builds a modified AS-REQ message with a forged PA-PAC-REQUEST field and manipulated authorization data
2. PAC Bypass: Sets specific bit flags in the request body that trigger the vulnerable code path in kdsvc.dll
3. TGT Extraction: Parses the KDC response and extracts the forged TGT
4. Ticket Output: Saves the TGT as a Kirbi file for use with Impacket, Mimikatz, or other tools

Detailed Attack Flow

Attacker                         Domain Controller (KDC)
   |                                      |
   |  AS-REQ (forged PA-PAC-REQUEST)      |
   |  - cname: Administrator              |
   |  - sname: krbtgt/DOMAIN              |
   |  - padata: PA-PAC-REQUEST +          |
   |    forged auth-data                  |
   |------------------------------------->|
   |                                      |
   |  [Vulnerable Path]                   |
   |  1. KDC receives AS-REQ             |
   |  2. Checks PA-PAC-REQUEST flag      |
   |  3. **Bypasses pre-auth check**     |
   |  4. Skips PAC verification          |
   |  5. Generates TGT with arbitrary    |
   |     groups via auth-data            |
   |                                      |
   |  AS-REP (forged TGT)                 |
   |  - Encrypted with krbtgt key        |
   |  - Contains forged PAC              |
   |<-------------------------------------|
   |                                      |
   |  TGS-REQ (use forged TGT)           |
   |  - Request service ticket           |
   |  - For any service (CIFS, LDAP,     |
   |    HTTP, HOST)                       |
   |------------------------------------->|
   |                                      |
   |  TGS-REP (service ticket)           |
   |  - Legitimate service ticket        |
   |  - Attacker can now access          |
   |    any resource                     |
   |<-------------------------------------|

Mitigation

Immediate Actions

1. Apply Microsoft August 2025 Patch Tuesday updates — This is the primary fix. See the affected versions table above for the corresponding KB.

2. Monitor for exploitation attempts:

   • Event ID 4768 (Kerberos authentication ticket granted) — look for invalid or unusual TGT requests
   • Event ID 4769 (Kerberos service ticket requested) — look for anomalous service ticket patterns
   • Unexpected Kerberos traffic on port 88 from unknown sources

3. Network segmentation:

   • Restrict port 88/TCP-UDP access to domain controllers
   • Use firewalls to limit Kerberos traffic to authorized subnets only

4. Enable additional logging:

   • Enable Kerberos logging (NetworkProvider\Kerberos\Operational)
   • Enable PAC validation audit logging
   • Monitor for invalid PAC signatures

Detection Rules

Sigma Rule (AS-REQ without pre-auth):

title: CVE-2025-53779 Kerberos Authentication Bypass
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4768
    PreAuthenticationType: 0  # No pre-authentication required
  condition: selection
  falsepositives:
    - Users with "Do not require Kerberos preauthentication" set

Workarounds (if patch cannot be applied)

• Disable Kerberos PAC validation bypass: While no official workaround exists before patching, organizations can:
  • Restrict network access to domain controllers (port 88)
  • Enable Extended Protection for Authentication (EPA) on applications
  • Deploy Network Intrusion Detection System (NIDS) rules to detect malformed AS-REQ messages

References

1. Microsoft Security Response Center - CVE-2025-53779
2. Microsoft August 2025 Patch Tuesday Release Notes
3. Microsoft Security Update Guide
4. MITRE ATT&CK - Use Alternate Authentication Material: Pass the Ticket (T1550.003)
5. Impacket - Python library for Kerberos interaction
6. Kerberos Protocol Extensions (RFC 4120)
7. MS-KILE: Kerberos Protocol Extensions
8. MS-PAC: Privilege Attribute Certificate Data Structure

Disclaimer

This repository is provided for educational and authorized security testing purposes only. Unauthorized exploitation of CVE-2025-53779 against systems you do not own or do not have explicit written permission to test is illegal. The authors are not responsible for any misuse of this information.

License

This project is licensed under the MIT License - see the LICENSE file for details.