{"uuid": "17770e31-16af-4872-ad79-2657c3a1a50f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6324", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Tom Maddock\", \"Sylvain Monne\", \"juan vazquez \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in the Microsoft Kerberos implementation. The problem\\n          exists in the verification of the Privilege Attribute Certificate (PAC) from a Kerberos TGS\\n          request, where a domain user may forge a PAC with arbitrary privileges, including\\n          Domain Administrator. This module requests a TGT ticket with a forged PAC and exports it to\\n          a MIT Kerberos Credential Cache file. It can be loaded on Windows systems with the Mimikatz\\n          help. It has been tested successfully on Windows 2008.\", \"disclosure_date\": \"2014-11-18\", \"fullname\": \"auxiliary/admin/kerberos/ms14_068_kerberos_checksum\", \"is_install_path\": true, \"mod_time\": \"2026-02-03 20:58:31 +0000\", \"name\": \"MS14-068 Microsoft Kerberos Checksum Validation Vulnerability\", \"needs_cleanup\": false, \"notes\": {\"AKA\": [\"ESKIMOROLL\"], \"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"admin/kerberos/ms14_068_kerberos_checksum\", \"references\": [\"CVE-2014-6324\", \"MSB-MS14-068\", \"OSVDB-114751\", \"URL-http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx\", \"URL-https://labs.mwrinfosecurity.com/blog/2014/12/16/digging-into-ms14-068-exploitation-and-defence/\", \"URL-http://web.archive.org/web/20180107213459/https://github.com/bidord/pykek\", \"URL-https://www.rapid7.com/blog/post/2014/12/25/12-days-of-haxmas-ms14-068-now-in-metasploit\", \"ATT&CK-T1068\", \"ATT&CK-T1212\", \"ATT&CK-T1558.001\"], \"rport\": 88, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:52.337871Z"}