MS14-068 Checksum Validation

MS14-068 (CVE-2014-6324) abuses incorrect signature validation in the Windows Kerberos KDC so an unpatched domain controller accepts a forged Privilege Attribute Certificate (PAC) and returns a privileged Kerberos ticket. The documented PyKEK and Metasploit paths require valid domain-user credentials and the full user SID, and produce a MIT Kerberos ccache containing a TGT; they do not require the KRBTGT secret. The procedure requires reachability to a vulnerable KDC, and the ticket must still be accepted by a target service.