Exploitation Summary
CVE-2014-6324 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 25, 2022.
EIP tracks 3 public exploits from researchers including Sylvain Monne, dark-vex, Tom Maddock, Sylvain Monne, juan vazquez, including a Metasploit module auxiliary/admin/kerberos/ms14_068_kerberos_checksum.
AI-analyzed exploit summary This exploit leverages CVE-2014-6324 (MS14-068) to forge Kerberos tickets, allowing privilege escalation in Active Directory environments. It manipulates PAC validation to grant arbitrary domain privileges.
Description
The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."
Exploits (3)
This exploit leverages CVE-2014-6324 (MS14-068) to forge Kerberos tickets, allowing privilege escalation in Active Directory environments. It manipulates PAC validation to grant arbitrary domain privileges.
This repository contains a functional Python exploit for CVE-2014-6324 (MS14-068), a Kerberos vulnerability allowing privilege escalation in Active Directory. The exploit manipulates Kerberos tickets to grant domain admin privileges to a user account.
This Metasploit module exploits CVE-2014-6324 (MS14-068) by forging a Privilege Attribute Certificate (PAC) in Kerberos TGS requests to escalate domain user privileges to Domain Administrator. It generates a TGT ticket with a forged PAC and exports it to a MIT Kerberos Credential Cache file.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H