MITM6-based Python proof of concept that abuses DNS CNAME resolution to make a Windows client request a Kerberos service ticket (TGS) for the CNAME target hostname, which becomes the SPN. From an on-path DNS man-in-the-middle position, an operator can relay the client's authentication to a compatible target; relay succeeds only where the target service and protocol protections allow it. Microsoft's CVE-2026-20929 update adds CBT support in HTTP.sys for HTTP relay, reducing that path without removing the underlying CNAME-to-SPN behavior.
Python
RESTRICTED_ACCESS_BLUR_MARKER