cve.bz

CAPEC-652

Use of Known Kerberos Credentials

High severityMedium likelihoodStandard pattern

An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.

On this page

Kerberos is the default authentication method for Windows domains and is also used across many operating systems. Attacks leveraging trusted Kerberos credentials can result in numerous consequences, depending on what Kerberos credential is stolen. For example, Kerberos service accounts are typically used to run services or scheduled tasks pertaining to authentication. However, these credentials are often weak and never expire, in addition to possessing local or domain administrator privileges. If an adversary is able to acquire these credentials, it could result in lateral movement within the domain or access to any resources the service account is privileged to access, among other things. Ultimately, successful spoofing and impersonation of trusted Kerberos credentials can lead to an adversary breaking authentication, authorization, and audit controls with the target system or application.

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-652: Use of Known Kerberos Credentials: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/652.html and https://cve.bz/cve/capec/652?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Acquire known Kerberos credentials] The adversary must obtain known Kerberos credentials in order to access the target system, application, or service within the domain.

      4 techniques
      • An adversary purchases breached Kerberos service account username/password combinations or leaked hashed passwords from the dark web.
      • An adversary guesses the credentials to a weak Kerberos service account.
      • An adversary conducts a sniffing attack to steal Kerberos tickets as they are transmitted.
      • An adversary conducts a Kerberoasting attack.

  2. Experiment

    They probe what they found.

    1. [Attempt Kerberos authentication] Try each Kerberos credential against various resources within the domain until the target grants access.

      2 techniques
      • Manually or automatically enter each Kerberos service account credential through the target's interface.
      • Attempt a Pass the Ticket attack.

  3. Exploit

    They carry out the attack.

    1. [Impersonate] An adversary can use successful experiments or authentications to impersonate an authorized user or system, or to laterally move within the domain

    2. [Spoofing] Malicious data can be injected into the target system or into other systems on the domain. The adversary can also pose as a legitimate domain user to perform social engineering attacks.

    3. [Data Exfiltration] The adversary can obtain sensitive data contained within domain systems or applications.

Prerequisites

  • The system/application leverages Kerberos authentication.

  • The system/application uses one factor password-based authentication, SSO, and/or cloud-based authentication for Kerberos service accounts.

  • The system/application does not have a sound password policy that is being enforced for Kerberos service accounts.

  • The system/application does not implement an effective password throttling mechanism for authenticating to Kerberos service accounts.

  • The targeted network allows for network sniffing attacks to succeed.

Skills required

  • Low skill

    Once an adversary obtains a known Kerberos credential, leveraging it is trivial.

Resources required

  • A valid Kerberos ticket or a known Kerberos service account credential.

Signs of an attack

  • Authentication attempts use expired or invalid credentials.

  • Authentication attempts are originating from IP addresses or locations that are inconsistent with an account's normal IP addresses or locations.

  • Data is being transferred and/or removed from systems/applications within the network.

  • Suspicious or Malicious software is downloaded/installed on systems within the domain.

  • Messages from a legitimate user appear to contain suspicious links or communications not consistent with the user's normal behavior.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Gain PrivilegesConfidentiality, Access Control, Authentication
Read DataConfidentiality, Authorization
Modify DataIntegrity

Mitigations

  • Create a strong password policy and ensure that your system enforces this policy for Kerberos service accounts.

  • Ensure Kerberos service accounts are not reusing username/password combinations for multiple systems, applications, or services.

  • Do not reuse Kerberos service account credentials across systems.

  • Deny remote use of Kerberos service account credentials to log into domain systems.

  • Do not allow Kerberos service accounts to be a local administrator on more than one system.

  • Enable at least AES Kerberos encryption for tickets.

  • Monitor system and domain logs for abnormal credential access.

Weaknesses it exploits

  • CWE-262 Not Using Password Aging
  • CWE-263 Password Aging with Long Expiration
  • CWE-294 Authentication Bypass by Capture-replay
  • CWE-307 Improper Restriction of Excessive Authentication Attempts
  • CWE-308 Use of Single-factor Authentication
  • CWE-309 Use of Password System for Primary Authentication
  • CWE-522 Insufficiently Protected Credentials
  • CWE-654 Reliance on a Single Factor in a Security Decision
  • CWE-836 Use of Password Hash Instead of Password for Authentication

Recent CVEs with these weaknesses

  1. –CVE-2026-97867

    The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to…

  2. –CVE-2026-111248

    The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who ob…

  3. 6.0CVE-2026-89125

    Due to Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager, an attacker with administrative privileges could obtain sensitive information from stored data. This may allow correlation of creden…

  4. 8.9CVE-2026-76966

    Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management,…

  5. 5.4CVE-2026-113968

    A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7…

  6. 5.4CVE-2026-113964

    A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7…

  7. 7.4CVE-2026-123801

    SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseT…

  8. 7.1CVE-2026-115340

    Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.

The newest records naming one of them. Each weakness's page lists them all.

Part of
Can lead to
More specific patterns

Examples

Bronze Butler (also known as Tick), has been shown to leverage forged Kerberos Ticket Granting Tickets (TGTs)…

Bronze Butler (also known as Tick), has been shown to leverage forged Kerberos Ticket Granting Tickets (TGTs) and Ticket Granting Service (TGS) tickets to maintain administrative access on a number of systems. [REF-584]

PowerSploit's Invoke-Kerberoast module can be leveraged to request Ticket Granting Service (TGS) tickets and …

PowerSploit's Invoke-Kerberoast module can be leveraged to request Ticket Granting Service (TGS) tickets and return crackable ticket hashes. [REF-585] [REF-586]

MITRE's words, unchanged: CAPEC-652 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.