CVE-2024-20674 PoC — Microsoft Windows Kerberos 安全漏洞

介绍

# CVE-2024-20674

This is my take at an exploit of the public CVE CVE-2024-20674 to achieve Kerberos mutual authentication bypass using a logic bug in the client-side handling of Kerberos U2U TGT-REP.
This can be used for instance to serve arbitrary GPOs when spoofing the DC to a client, and take control of a machine.

**Pre-requisites**: Network Man In the Middle, unauthenticated.

### Explanation of the exploit in this paper

https://www.sstic.org/2025/presentation/l_outillage_reseau_windows_une_affaire_d_implementation/

### Demo

https://github.com/user-attachments/assets/6dc25e26-b42a-41a0-bc73-8fc4a0a0c5ee

### Warning

The demo/ folder contains GPOs that will probably destroy the client configuration (add guest user to Administrators, disable UAC, disable firewall)

文件快照

备注