CVE-2020-17049: Kerberos Bronze Bit Attack – Practical Exploitation

Jake Karnes
December 8th, 2020

CVE-2020-17049: Kerberos Bronze Bit Attack – Practical Exploitation

This post reviews how the Kerberos Bronze Bit vulnerability (CVE-2020-17049) can be exploited in practice. I strongly suggest first reading the Bronze Bit Attack in Theory post to understand why and how this attacks works. It is also worth noting that Microsoft published a patch for the vulnerability on November 10, 2020. The patch rollout […]
Jake Karnes
December 8th, 2020

CVE-2020-17049: Kerberos Bronze Bit Attack – Theory

Introduction and Background This attack expands upon the excellent research documented by Elad Shamir in “Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory.” I’ll cover the key points below, but his article a great resource and primer for Kerberos and constrained delegation in AD. If you’re already familiar with the Kerberos fundamentals, […]
Jake Karnes
December 8th, 2020

CVE-2020-17049: Kerberos Bronze Bit Attack – Overview

With the release of Microsoft’s patch to fix CVE-2020-17049, I’m excited to share details about this vulnerability and how it could be exploited. This post is only a very high-level overview, and I strongly encourage readers who are interested to check out my follow-up posts which provide much more depth: To learn about Kerberos, Kerberos […]
Alex Poorman
October 29th, 2020

NetblockTool: The Easy Way to Find IP Addresses Owned by a Company

TL;DR Use NetblockTool to easily dump a unique list of IP addresses belonging to a company and its subsidiaries. Download the tool here: https://github.com/NetSPI/NetblockTool The Problem A problem that I was frequently running into for both offensive and defensive roles is determining the IP addresses that a company owns and uses. Traditionally, gathering a list […]
Karl Fosaaen
October 22nd, 2020

A Beginners Guide to Gathering Azure Passwords

It has been a while since the initial release (August 2018) of the Get-AzurePasswords module within MicroBurst, so I figured it was time to do an overview post that explains how to use each option within the tool. Since each targeted service in the script has a different way of getting credentials, I want users […]
Alex Poorman
September 24th, 2020

AutoDirbuster – Automatically Run and Save DirBuster Scans for Multiple IPs

If you’ve used OWASP’s DirBuster, you know it’s a great directory buster. Its speed and reliability make it one of the best directory busters currently available. However, it has one big limitation: it can only scan one target at a time. This is fine if you’re only attacking one target, but if you are attacking […]
Karl Fosaaen
August 17th, 2020

Lateral Movement in Azure App Services

We test a lot of web applications at NetSPI, and as everyone continues to move their operations into the cloud, we’re running into more instances of applications being run on Azure App Services. Whenever we run into an App Services application with a serious vulnerability, I’ll frequently get a ping asking about next steps to […]
Karl Fosaaen
July 29th, 2020

Get-AzPasswords: Encrypting Automation Password Data

Get-AzPasswords is a function within the MicroBurst toolkit that’s used to get passwords from Azure subscriptions using the Az PowerShell modules. As part of this, the function supports gathering passwords and certificates that are attached to automation accounts. These credentials can be stored in a few different ways: Credentials – Username/Password combinations Connections – Service […]
Karl Fosaaen
July 16th, 2020

Azure File Shares for Pentesters

For many years, pentester-hosted SMB shares have been a common technology to use during internal penetration tests for getting tools over to, and data off of, target systems. The process is simple: share a folder from your testing system, execute a “net use z: \\testingbox\tools” from your target, and run your tools from the share. […]

Need a Quote?

Common Questions

What is Penetration Testing as a Service (PTaaS)?

PTaaS is NetSPI’s delivery model for penetration testing. It enables customers to simplify the scoping of new engagements, view their testing results in real time, orchestrate faster remediation, perform always-on continuous testing, and more - all through the Resolve™ vulnerability management and orchestration platform. Learn More

Why should I use NetSPI?

Your attack surface is constantly evolving. We help organizations defend against real-world attacks by being the best at simulating real-world, sophisticated adversaries with the products, services, and training we provide. Our historical testing data shows that there is simply no replacement for human-led manual deep dive testing. This level of testing finds the most severe vulnerabilities that tools will never uncover. Our proven methodology ensures that the client experience and our findings aren’t only as good as the latest tester assigned to your project. That consistency gives our customers assurance that if vulnerabilities exist, we will find them. In addition, our Resolve platform delivers automation to ensure our people spend time looking for the vulnerabilities that tools miss. We provide automated and manual testing of all aspects of an organization’s entire attack surface, including external and internal network, application, cloud, and physical security. We know how attackers think and operate, allowing us to help our customers better defend against the threats they face daily.