User-to-User Authentication: Down the Rabbit Hole – Part 1

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR: This blog post covers Windows internals and how Kerberos user-to-user (U2U) authentication works under the hood versus showing how to execute an attack.

U2U authentication came into the spotlight after the Active Directory Certificate Services (ADCS), UnPAC-the-Hash, and Shadow Credentials attacks. While the attack technique is popular and common amongst red teamers, there’s limited information distilling how and why the technique works. In this blog post, we will cover the intricacies of U2U authentication and how it differs from traditional Kerberos.

Kerberos Primer

Kerberos authenticates clients with tickets so the client never sends their passwords over the wire. The client starts by sending an authentication server (AS) request (AS-REQ) to the Key Distribution Center (KDC) that contains a timestamp encrypted with a key derived from the client’s password. The username itself is sent in plaintext so the KDC can look up the matching encryption key in the Active Directory (AD) database. The KDC uses that key to decrypt and verify the timestamp, which proves the client knows the password.

If verification succeeds, the KDC builds a ticket-granting ticket (TGT), embeds the user’s metadata inside the Privileged Attribute Certificate (PAC), and encrypts the TGT with the KRBTGT encryption key. It also generates a session key and places one copy inside the TGT and a second copy in the EncASRepPart of the AS response (AS-REP), which is encrypted with the client’s encryption key. The client receives the AS-REP, decrypts the EncASRepPart with its own key, retrieves the …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://specterops.io/blog/2026/06/09/user-to-user-authentication-down-the-rabbit-hole-part-1/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.