Security/Dollar Ticket Attack

The "Dollar Ticket Attack" / Name confusion in Kerberos

This page attempts to document the "Dollar Ticket Attack" on Active Directory. There are many other security issues, some related, that come form the same tree, including:

* Certifried: Active Directory Domain Privilege Escalation (CVE-2022–26923)

CVEs and Announcements

• Samba CVE-2020-25717 A user in an AD Domain could become root on domain members

• Samba CVE-2020-25719 Samba AD DC did not always rely on the SID and PAC in Kerberos tickets.

• Microsoft CVE-2021-42287 KB5008380—Authentication updates

Announcements

CERT NZ Announcement

Talks

• SambaXP: [https://www.youtube.com/watch?v=1BnraIAcybg The inside story on the

dollar ticket attack - Youtube Video] PDF===

Blogs

https://www.catalyst.net.nz/blog/stay-curious-dollar-ticket-security-issue

Documentation

MS-KILE 3.3.5.6.1 Client Principal Lookup