Identity Crisis - Novel Vulnerabilities leading to Kerberos Downgrade, DoS, and Full Domain Takeover

The talk starts from a persistence technique that uses invisible Unicode characters to create Active Directory accounts that look like duplicates. The speaker found that the directory ignores some of these characters in LDAP filters, so a query without the character still returns the object. That behavior led to a question about whether uniqueness checks on other attributes could be sidestepped in the same way.

Service principal names and user principal names must be unique across the forest, but the speaker showed that the check can be bypassed with unfilterable characters. A duplicate host-class SPN lets an attacker deny service to a share, and an explicit duplicate makes the domain controller fail Kerberos so clients silently fall back to NTLM. A second chain abuses the Kerberos change-password flow. A low-privileged user spoofs a UPN that matches a domain admin's account name, obtains a ticket that the domain controller accepts, and resets the admin's password. The speaker reported both issues to Microsoft, which patched them in March and April.

For defenders, the recommendation is to patch domain controllers first. If patching is delayed, the talk suggests alerting on SPN or UPN changes that collide with existing values, and correlating them with password reset events. The speaker also stressed least privilege, MFA and behavioral detection for tier-zero accounts. A tool that automates the attack flow was announced for testing.