Saint Kerberos Bronze Bit, Who Forged the Delegation

Patron of domain admins, constrained delegation, and anyone who thinks a single bit makes no difference.

Life

On 8 December 2020 Jake Karnes of NetSPI published the technique and exploit for CVE-2020-17049. Anyone holding the hash of a service account with constrained delegation could use S4U2self to request a ticket for any user and then flip the 'forwardable' flag. That flag was protected only by encryption with the service's password: one bit changed and the ticket was good for anyone, members of the Protected Users group included.

Prayer

O Saint Kerberos Bronze Bit, who flips a flag like turning a coin, let our tickets be signed and not merely encrypted. Amen.

How to celebrate

Celebrated by installing Microsoft's PAC signature patch and reviewing who really needs delegation.

A bronze bit opens golden doors.