Metasploit Wrap Up: This One Goes to Sixteen!

What it is

This Metasploit weekly update adds a notable new capability beyond the module list itself: a native Kerberos relay module (server/relay/esc8_kerberos, PR #21709, by Pushpender Rathore) exploiting CVE-2026-20929, an ESC8 (AD CS Web Enrollment) attack via SMB-to-HTTP Kerberos relay. This is distinct from the module summary's mention of "ESC8" — the specific CVE and mechanism aren't in the existing summary.

How it works

The module captures an SMB2 AP-REQ (Kerberos authentication request) from a client that has been coerced into authenticating, then relays that captured authentication over HTTP(S) to the target AD CS Web Enrollment endpoint. This lets the attacker request and obtain a certificate on behalf of the coerced victim, which can then be used to get a valid Kerberos TGT for that victim — all without ever knowing the victim's credentials. This is Metasploit's first native relay-stack implementation of this cross-protocol (SMB→HTTP) Kerberos relay technique.

Preconditions / Affected

• Requires an AD CS environment with Web Enrollment (HTTP) enabled — the classic ESC8 misconfiguration.
• Requires the ability to coerce a victim machine into authenticating via SMB (e.g., via a coercion primitive) to the attacker.
• No authentication/credentials for the victim are needed; the attack relays an intercepted authentication attempt.

What to do

The blog doesn't give mitigation guidance for ESC8 itself (that's standard AD CS hardening — disabling HTTP enrollment or enforcing Extended Protection for Authentication), but for defenders testing exposure, the practical action is to pull the latest Metasploit (msfupdate) and use the esc8_kerberos auxiliary module to validate whether an AD CS deployment is relay-vulnerable, pairing it with an SMB coercion module already in the framework.

Caveats

The post gives no detail on which coercion primitives pair with this module, nor any indication of detection signatures for the relay traffic — only the exploitation chain mechanism is described.