🔐 FreeIPA Rosting (CVE-2024-3183)

A vulnerability recently discovered by my friend @Im10n in FreeIPA involves a Kerberos TGS-REQ being encrypted using the client’s session key. If a principal’s key is compromised, an attacker could potentially perform offline brute-force attacks to decrypt tickets by exploiting the encrypted key and associated salts.

🔗Source:
https://github.com/Cyxow/CVE-2024-3183-POC

#freeipa #kerberos #hashcat #cve

———
Добавляем доклад Миши в вишлист на Offzone 🚶‍♂️