CVE-2025-53779: Microsoft Windows Kerberos Authentication Bypass

CVSS Score: 9.8 (Critical)
Status: Active exploitation in the wild
Disclosure: Microsoft August 2025 Patch Tuesday (Zero-Day)

---

Overview

CVE-2025-53779 is a critical authentication bypass vulnerability in Microsoft Windows Kerberos protocol implementation. An unauthenticated attacker can exploit this flaw to bypass Kerberos authentication entirely, impersonating any domain user — including domain administrators — without possessing valid credentials or any cryptographic material.

Microsoft assigned this vulnerability a CVSS 9.8 (Critical) rating due to its low attack complexity, no required privileges, no user interaction, and the potential for complete compromise of domain-joined systems.

---

Technical Details

Root Cause

The vulnerability resides in the Kerberos Key Distribution Center (KDC) service (kdsvc.dll) on Windows domain controllers. Specifically, a validation logic error in the Privilege Attribute Certificate (PAC) verification routine allows an attacker to craft an AS-REQ or TGS-REQ message that bypasses the standard authentication checks.

Affected Component

• Component: Kerberos Key Distribution Center (KDC)
• Binary: kdsvc.dll
• Protocol: Kerberos v5 (RFC 4120)
• Vulnerability Type: Authentication Bypass via PAC Validation Logic Flaw

Attack Vector

The KDC fails to properly validate the pac-signature-data field in the PAC structure when specific flags are set in the Kerberos message body. By sending a specially crafted AS-REQ with a manipulated PA-PAC-REQUEST padata type and a forged authorization data entry, the attacker tricks the KDC into issuing a Ticket-Granting Ticket (TGT) for any user principal name (UPN) without requiring the corresponding long-term key.

The attack bypasses pre-authentication (the REQUIRES_PRE_AUTH flag is effectively ignored) and skips PAC verification entirely, allowing the generated ticket to contain arbitrary group memberships (e.g., Domain Admins, Enterprise Admins).

Impact

• Complete Authentication Bypass: No credentials required to obtain a valid Kerberos TGT
• Privilege Escalation: Ability to impersonate any domain user, including domain administrators
• Lateral Movement: Once a TGT is obtained, an attacker can request service tickets for any resource
• Persistence: Golden/silver ticket-style attacks become trivial
• Full Domain Compromise: An attacker effectively gains Domain Admin privileges from an unauthenticated position

---

Affected Versions

All supported versions of Windows Server are affected prior to the August 2025 security update:

Windows Version	Affected	Fixed Update
Windows Server 2025	✅ Yes	KB5044289
Windows Server 2022	✅ Yes	KB5044285
Windows Server 2019	✅ Yes	KB5044277
Windows Server 2016	✅ Yes	KB5044293
Windows Server 2012 R2	✅ Yes	KB5044297
Windows Server 2012	✅ Yes	KB5044291
Windows Server 2008 R2 (ESU)	✅ Yes	KB5044301
Windows Server 2008 (ESU)	✅ Yes	KB5044303

Note: Windows client versions (Windows 10, Windows 11) are not affected as they do not run the KDC service.

---

Reproduction Steps

Prerequisites

1. A Windows domain controller running an unpatched Windows Server version (see affected versions above)
2. Network access to the domain controller (port 88/TCP and/or 88/UDP must be open)
3. Python 3.8+ with the impacket library installed
4. This PoC script (exploit.py)

Step 1: Install Dependencies

pip install impacket pycryptodome

Or using the provided requirements.txt:

pip install -r requirements.txt

Step 2: Identify a Target Domain Controller

Use Nmap to discover Kerberos services:

nmap -sU -p 88 --script krb5-enum-users <target-ip>

Or use the built-in Kerberos scanning:

python exploit.py --scan <target-ip>

Step 3: Enumerate Domain Users (Optional)

If you do not know domain users, enumerate them via Kerberos AS-REP roasting or LDAP:

python exploit.py --enum <target-ip> <domain>

Step 4: Execute the Exploit

Generate a forged TGT for a target user:

python exploit.py --dc-ip <dc-ip> --domain <domain> --target-user <username>

Example:

python exploit.py --dc-ip 192.168.1.10 --domain corp.local --target-user Administrator

Step 5: Verify the Ticket

The exploit outputs a Kirbi-formatted ticket file. Use Impacket tools to verify:

# Export the ticket
set KRB5CCNAME=ticket.kirbi

# Use the ticket to access a resource
python examples/secretsdump.py -k -no-pass <domain>/Administrator@<target>

Step 6: Post-Exploitation

Once a valid TGT is obtained, you can:

• Dump hashes: secretsdump.py -k -no-pass domain/Administrator@<dc>
• PTT (Pass-the-Ticket): mimikatz "kerberos::ptt ticket.kirbi"
• Golden Ticket: The same technique can generate tickets for any user
• Silver Ticket: Request service tickets for specific services (CIFS, HTTP, LDAP)

---

PoC (Proof of Concept)

The accompanying exploit.py implements the following attack flow:

1. AS-REQ Construction: Builds a modified AS-REQ message with a forged PA-PAC-REQUEST field and manipulated authorization data
2. PAC Bypass: Sets specific bit flags in the request body that trigger the vulnerable code path in kdsvc.dll
3. TGT Extraction: Parses the KDC response and extracts the forged TGT
4. Ticket Output: Saves the TGT as a Kirbi file for use with Impacket, Mimikatz, or other tools

Detailed Attack Flow

Attacker                         Domain Controller (KDC)
   |                                      |
   |  AS-REQ (forged PA-PAC-REQUEST)      |
   |  - cname: Administrator              |
   |  - sname: krbtgt/DOMAIN              |
   |  - padata: PA-PAC-REQUEST +          |
   |    forged auth-data                  |
   |------------------------------------->|
   |                                      |
   |  [Vulnerable Path]                   |
   |  1. KDC receives AS-REQ             |
   |  2. Checks PA-PAC-REQUEST flag      |
   |  3. **Bypasses pre-auth check**     |
   |  4. Skips PAC verification          |
   |  5. Generates TGT with arbitrary    |
   |     groups via auth-data            |
   |                                      |
   |  AS-REP (forged TGT)                 |
   |  - Encrypted with krbtgt key        |
   |  - Contains forged PAC              |
   |<-------------------------------------|
   |                                      |
   |  TGS-REQ (use forged TGT)           |
   |  - Request service ticket           |
   |  - For any service (CIFS, LDAP,     |
   |    HTTP, HOST)                       |
   |------------------------------------->|
   |                                      |
   |  TGS-REP (service ticket)           |
   |  - Legitimate service ticket        |
   |  - Attacker can now access          |
   |    any resource                     |
   |<-------------------------------------|

---

Mitigation

Immediate Actions

1. Apply Microsoft August 2025 Patch Tuesday updates — This is the primary fix. See the affected versions table above for the corresponding KB.

2. Monitor for exploitation attempts:

   • Event ID 4768 (Kerberos authentication ticket granted) — look for invalid or unusual TGT requests
   • Event ID 4769 (Kerberos service ticket requested) — look for anomalous service ticket patterns
   • Unexpected Kerberos traffic on port 88 from unknown sources

3. Network segmentation:

   • Restrict port 88/TCP-UDP access to domain controllers
   • Use firewalls to limit Kerberos traffic to authorized subnets only

4. Enable additional logging:

   • Enable Kerberos logging (NetworkProvider\Kerberos\Operational)
   • Enable PAC validation audit logging
   • Monitor for invalid PAC signatures