MS14-068 (CVE-2014-6324)

MS14-068 is the original PAC forgery privilege escalation: on unpatched (pre-Nov-2014) DCs, any authenticated user could forge a PAC claiming Domain Admin membership and have the KDC accept it — a one-step domain takeover from a normal account. It’s historical (patched everywhere for a decade) but it’s the canonical demonstration of why the PAC must be validated, still appears on ancient DCs and CTF/lab boxes, and is the conceptual ancestor of the modern PAC attacks (nopac, the forged-ticket family). It belongs in any exhaustive Kerberos attack map.

The bug

The PAC carries the user’s group memberships and is protected by signatures. The flaw: the DC validated the PAC’s signature using a checksum type the client got to choose — including unkeyed checksums (e.g. plain MD5) that require no secret. So a user could:

1. Request a TGT normally (they’re a valid low-priv user).
2. Build a PAC that lists them in Domain Admins (SID 512).
3. Sign it with an unkeyed checksum the DC would nonetheless accept.
4. Present it — the DC trusts the forged group membership → the user is DA.

No krbtgt key, no cracking — just a logic flaw in signature validation.

Exploitation

# PyKEK — forge the ticket for a low-priv user, then inject it
python ms14-068.py -u user@corp.local -s <user-SID> -d dc01.corp.local -p Password1
# -> produces a .ccache; use it (mimikatz kerberos::ptc / export KRB5CCNAME)

# Impacket goldenPac.py — chains the forgery straight to a SYSTEM shell on a target
goldenPac.py corp.local/user:'Password1'@dc01.corp.local

goldenPac.py is the end-to-end: forge → get a service ticket → psexec-style SYSTEM shell on the DC.

Relation to the modern family

• It’s PAC forgery via a validation flaw; Golden/Silver tickets forge the whole ticket with a stolen key instead.
• nopac (CVE-2021-42287) is the spiritual successor — a different logic flaw (name/S4U2self fallback) reaching the same “impersonate a privileged principal” outcome from an ordinary account.
• All three underline the same lesson tracked in kerberos-pac: the PAC’s integrity is what stands between a normal user and Domain Admin.

Detection / mitigation

• Patch (MS14-068 / KB3011780) — the fix enforces proper keyed PAC signature validation; this is a solved problem on maintained DCs.
• On unpatched estates: a TGT/PAC with Domain Admins for an account that isn’t one, and forged-ticket tells (as in golden-silver-tickets — anomalous group SIDs, unusual client). Any DC still vulnerable is a critical finding in its own right.

Links

• kerberos-pac — the PAC and its signatures (what the bug subverted)
• nopac — the modern PAC/identity-confusion successor
• golden-silver-tickets — key-based ticket forgery (contrast)
• dcsync / domain-controller — the DA end-state and the target
• kerberos-authentication — where PAC validation sits in the flow