Windows Kerberos AS-REQ "till" is a hardcoded constant and other AD time findings from chasing KRB_AP_ERR_SKEW
This report discusses how Windows Domain Controllers (DCs) expose their exact time to unauthenticated clients over multiple protocols including CLDAP, SMB, NTP, Kerberos error messages, and NTLM. A notable finding is that the Kerberos AS-REQ "till" field is a hardcoded constant timestamp rather than a computed value, which can serve as a fingerprint. The research includes an open-source tool, Skewrun, that leverages these time disclosures to synchronize time for Kerberos authentication without changing the local system clock, addressing the KRB_AP_ERR_SKEW error. The findings also highlight protocol-specific behaviors that can be used for detection or evasion in security monitoring. No direct vulnerability or exploit is described, but the information aids red teams and defenders in understanding and detecting time-based protocol interactions with Active Directory.
AI Analysis
Technical Summary
Windows Domain Controllers leak their current time to unauthenticated clients via five protocols: CLDAP rootDSE queries, SMB2 NEGOTIATE responses, NTP/SNTP, Kerberos KRB-ERROR messages, and NTLM type-2 challenges. The Kerberos AS-REQ "till" field is a hardcoded constant timestamp (2037 for most Windows versions, 9999 for Windows 11 22H2+), not dynamically computed, which can be used as a fingerprint for detection. The research includes the development of Skewrun, an open-source Rust tool and library that extracts DC time stealthily and uses libfaketime injection to run Kerberos-dependent tools on desynchronized Linux hosts without root privileges. The tool mimics Windows network stack behaviors to reduce forensic noise and evade detection. The study clarifies misconceptions about DC locator pings and provides protocol-specific insights useful for blue teams and red teams. No patch or vulnerability fix is indicated.
Potential Impact
There is no direct vulnerability or exploit described in this report. The impact lies in the exposure of DC time to unauthenticated clients, which can be used by attackers or red teams to synchronize time and bypass Kerberos clock skew errors without changing system clocks. This capability can facilitate certain penetration testing or attack scenarios involving Kerberos authentication. Additionally, the hardcoded 'till' timestamp in Kerberos AS-REQ messages can serve as a fingerprint for detection by defenders. The information may aid defenders in creating detection rules and red teams in evasion techniques. No known exploits in the wild are reported.
Mitigation Recommendations
No official patch or fix is indicated or required as this behavior is inherent to Windows DC protocols. Defenders can leverage the fingerprinting characteristics described (e.g., hardcoded Kerberos 'till' timestamp, CLDAP timeLimit=0, SMB dialect and capabilities) to create detection rules and baseline normal traffic. Red teams and penetration testers can use the Skewrun tool to handle Kerberos clock skew issues without changing system time. No urgent remediation is necessary, but monitoring for unusual time-based protocol requests may be beneficial.
Windows Kerberos AS-REQ "till" is a hardcoded constant and other AD time findings from chasing KRB_AP_ERR_SKEW
Description
This report discusses how Windows Domain Controllers (DCs) expose their exact time to unauthenticated clients over multiple protocols including CLDAP, SMB, NTP, Kerberos error messages, and NTLM. A notable finding is that the Kerberos AS-REQ "till" field is a hardcoded constant timestamp rather than a computed value, which can serve as a fingerprint. The research includes an open-source tool, Skewrun, that leverages these time disclosures to synchronize time for Kerberos authentication without changing the local system clock, addressing the KRB_AP_ERR_SKEW error. The findings also highlight protocol-specific behaviors that can be used for detection or evasion in security monitoring. No direct vulnerability or exploit is described, but the information aids red teams and defenders in understanding and detecting time-based protocol interactions with Active Directory.
Reddit Discussion
TL;DR: a Windows DC hands out its exact time to UNAUTHENTICATED clients over 5 protocols (CLDAP/SMB/NTP/Kerberos-error/NTLM). the AS-REQ "till" is a hardcoded constant (2037, or 9999 on Win11 22H2+) and getting it wrong can even break your own request. a few of these are cheap wire signatures for blue team to baseline. i wrapped it all in a small OSS tool + rust crate.
Hey hey, im a dev and i have been learning cybersec and acting as appsec eng and during the ctfs, boxes and authorized engagements the KRB_AP_ERR_SKEW found me a lot, the usual "correction" for it is to change the entire system clock or use some one liners that always get bugged or dont work in every environment, so i ended going down a rabbit hole to learn how the DC usually exposes its time (and also to find ways to slip past my own DetectionLab, so i could learn the detection/purple side too)
So, the DC leaks its time to UNAUTHENTICATED clients over several protocols:
- CLDAP rootDSE: the
currentTimeattribute in a base search - SMB2 NEGOTIATE: the
SystemTimefield in the response (fixed offset, all dialects) - NTP/SNTP: the obvious one
- Kerberos KRB-ERROR:
stime/suseceven from a failed AS-REQ - NTLM type-2 challenge:
MsvAvTimestampin the target info
The last one was also the funniest when i was testing, so i started tuning my detectionLab to get weird reqs and in the research ended up finding that the AS-REQ till is a hardcoded Windows constant, not a computed value (in my dev mind it would be computed, something like now+XXhrs or idk) but Real Windows fixes it as a far future constant 20370913024805Z (Win11 22H2+ switched to 99990913024805Z) credits to a Heimdal bug report with the captures, so in theory any jittered till is potentially a fingerprint, but it also makes sense in a way of if your box is too far behind even an now+XXhrs could end up in the past and you wouldnt even get the regular KRB_AP_ERR_SKEW
Another fun thing now about SMB is that real win 10/11 send SMB 3.1.1 (0x0311) in the NEGOTIATE dialect list + the mandatory PREAUTH_INTEGRITY_CAPABILITIES context and set the CLDAP timeLimit to 0 which can become cheap wire signatures to baseline if you're detecting this kind of activity
Also the CLDAP query people call a "DC Locator Ping" is actually a rootDSE diagnostic query (objectClass=*), which is ldapsearch/PowerShell-shaped traffic, not the machine-account DC Locator ping, different hiding pool than commonly assumed
If anyone wants to know more, see it or is dealing with the KRB_AP_ERR_SKEW I applied all this in a small open-source tool + a Rust crate for the extraction part (Skewrun)
Anyone working in a SOC: do you have detection rules for these kinds of time-based protocol requests?
And to the ones attacking, has anybody dealt with this kind of problem without LD_PRELOAD, any ideas of how to make it deal with static bins and/or be truly OS agnostic?
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Windows Domain Controllers leak their current time to unauthenticated clients via five protocols: CLDAP rootDSE queries, SMB2 NEGOTIATE responses, NTP/SNTP, Kerberos KRB-ERROR messages, and NTLM type-2 challenges. The Kerberos AS-REQ "till" field is a hardcoded constant timestamp (2037 for most Windows versions, 9999 for Windows 11 22H2+), not dynamically computed, which can be used as a fingerprint for detection. The research includes the development of Skewrun, an open-source Rust tool and library that extracts DC time stealthily and uses libfaketime injection to run Kerberos-dependent tools on desynchronized Linux hosts without root privileges. The tool mimics Windows network stack behaviors to reduce forensic noise and evade detection. The study clarifies misconceptions about DC locator pings and provides protocol-specific insights useful for blue teams and red teams. No patch or vulnerability fix is indicated.
Potential Impact
There is no direct vulnerability or exploit described in this report. The impact lies in the exposure of DC time to unauthenticated clients, which can be used by attackers or red teams to synchronize time and bypass Kerberos clock skew errors without changing system clocks. This capability can facilitate certain penetration testing or attack scenarios involving Kerberos authentication. Additionally, the hardcoded 'till' timestamp in Kerberos AS-REQ messages can serve as a fingerprint for detection by defenders. The information may aid defenders in creating detection rules and red teams in evasion techniques. No known exploits in the wild are reported.
Mitigation Recommendations
No official patch or fix is indicated or required as this behavior is inherent to Windows DC protocols. Defenders can leverage the fingerprinting characteristics described (e.g., hardcoded Kerberos 'till' timestamp, CLDAP timeLimit=0, SMB dialect and capabilities) to create detection rules and baseline normal traffic. Red teams and penetration testers can use the Skewrun tool to handle Kerberos clock skew issues without changing system time. No urgent remediation is necessary, but monitoring for unusual time-based protocol requests may be beneficial.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":[],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a60fc369c2644c7f866aa4d
Added to database: 07/22/2026, 17:21:58 UTC
Last enriched: 07/22/2026, 17:22:13 UTC
Last updated: 07/22/2026, 18:21:53 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.