Microsoft has issued several updates to help Systems Admins protect their networks against Kerberos Relay attacks. Microsoft have said no security patch will be provided to mitigate this attack vector, so config changes must be made to default Windows Domain Controller on premise installations.
Microsoft explains the vulnerability in a recent blog post: Detecting and preventing privilege escalation attacks leveraging Kerberos relaying:
By default, LDAP is vulnerable to credential relaying attacks. For example, in a credential relaying attack, a web server requesting a password to sign in would have its request relayed by an attacker to an authorized client. The attacker then relays the client reply containing the correct password back to the server, thus signing in. Once the attacker is signed in, they have the same permissions as the user whose credentials were relayed.
To protect against LDAP relay attacks, Microsoft recommends configuring LDAP to use LDAP channel binding and signing.
By exploiting an LDAP relay attack, a malicious user could insert a fake device into Active Directory and then use that to obtain a Kerberos ticket granting the ability to run arbitrary code on the target server. Although this is complex to achieve manually, a hacking tool KrbRelayUp was published on GitHub at the end of April which greatly simplifies this attack making exploitation much easier.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)