Overview

A very popular Kerberos-based attack for the last couple years has been KrbRelay. This technique was first discussed in a Google Project Zero post on October 2021, and then Cube0x0 made a public POC, KrbRelay in February 2022. In Aprl 2022, KrbRelayUp automated the most common pathways from KrbRelay

The idea is to relay an authentication request through a server back to the DC to get authenticated for whatever mischief the attacker desires.

After a full year of this bug being referred to as “not to be patched”, Microsoft changed their stance and did that in October 2022.

For this attack to work, the target must:

Not have the Oct 2022 patches; LDAP signing must be disabled (which is the Windows default). -0xdf