Machine Account Name Mapping to Local Admin (Dollar Ticket)

Abuse Active Directory machine-account name aliasing to authenticate to an AD-joined Linux host as a privileged local account. A domain user creates a computer account whose sAMAccountName is root$, requests a TGT for the unsuffixed principal root, then presents it through GSSAPI SSH. Where the KDC resolves that requested name to the computer account and the target's local authorization maps the returned root principal to local root without binding it to the directory account identity or PAC, the session runs as UID 0. This is conditional on KDC and target configuration; MIT Kerberos does not universally strip a trailing dollar sign.