ID:384 - Exploit for Kerberos privilege escalation in Windows and Windows Server - CVE-2016-3237

Link to public exploit:

Vulnerability description

The vulnerability allows an attacker with access to local network to gain elevated privileges.

The vulnerability exists in Kerberos implementation when handling password change request. A local attacker can make the operating system to fall back to NT LAN Manager (NTLM) Authentication Protocol as the default authentication protocol.

Successful exploitation of this vulnerability will allow a local attacker to launch a man-in-the-middle (MiTM) attack against the traffic passing between a domain controller and the target machine, intercept and decrypt credentials during password change request.

Remediation