Microsoft Windows Kerberos KDC Signature Verification Bypass and Domain Privilege Escalation (CVE-2014-6324)

1. Vulnerability Overview & Root Cause

This vulnerability exists in the Microsoft Kerberos Key Distribution Center (KDC) implementation within Active Directory (AD). When issuing Kerberos tickets, the KDC includes a Privilege Attribute Certificate (PAC) containing the user's group memberships. To prevent tampering, the PAC is signed using cryptographic keys. However, vulnerable KDCs fail to properly validate the signature algorithm specified in the PAC. This allows an attacker to specify a weak or arbitrary checksum algorithm (such as MD5) and sign the modified PAC with a key of their own choosing, which the KDC incorrectly validates as authentic.

2. Exploitation Mechanics & Attack Scenario

An attacker with valid, low-privileged domain user credentials can execute the following attack chain:

• Request a standard Ticket Granting Ticket (TGT) from the KDC.
• Modify the PAC data within the TGT to append high-privileged group SIDs, such as 'Domain Admins' (RID 512).
• Re-sign the tampered PAC using a custom key and specify a weak checksum algorithm that the vulnerable KDC accepts.
• Present the forged TGT to the KDC to request a Service Ticket (TGS). The KDC bypasses proper signature verification, trusts the forged PAC, and issues a highly privileged TGS, granting the attacker full Domain Admin rights.

3. Infrastructure & Business Impact

With a CVSS score of 8.8 and active exploitation in the wild (CISA KEV listed), this vulnerability poses an extreme risk to enterprise environments. Successful exploitation bypasses all logical access controls within the Active Directory forest. Attackers can deploy enterprise-wide ransomware, exfiltrate sensitive intellectual property, and establish persistent administrative backdoors, resulting in catastrophic business disruption and loss of trust.