Security/Dollar Ticket Attack

The "Dollar Ticket Attack" / Name confusion in Kerberos

This page attempts to document the "Dollar Ticket Attack" on Active Directory. There are many other security issues, some related, that come form the same tree, including:

• Certifried: Active Directory Domain Privilege Escalation (CVE-2022–26923)

CVEs and Announcements

• Samba CVE-2020-25717 A user in an AD Domain could become root on domain members

• Samba CVE-2020-25719 Samba AD DC did not always rely on the SID and PAC in Kerberos tickets.

• Microsoft CVE-2021-42287 KB5008380—Authentication updates

Announcements

CERT NZ Announcement of AD DC security issue and patch

Talks

• SambaXP: The inside story on the dollar ticket attack - Youtube Video PDF (longer)

• Kawaiicon: Live stream replay @ Youtube PDF without embedded video (shorter, more focus on the remaining still open issues)

Blogs

https://www.catalyst.net.nz/blog/stay-curious-dollar-ticket-security-issue

Documentation

MS-KILE 3.3.5.6.1 Client Principal Lookup