88/tcp/udp - Pentesting Kerberos

👉 Overview

👀 What ?

Kerberos is a computer-network authentication protocol that allows nodes to securely identify each other in a non-secure network. It's used predominantly in Microsoft's Active Directory and uses the TCP/UDP port 88.

🧐 Why ?

Understanding Kerberos and its vulnerabilities is crucial because it's widely used in enterprise environments, particularly in Active Directory domains. Exploiting these vulnerabilities can lead to severe consequences such as unauthorized access and data breaches.

⛏️ How ?

Pentesting Kerberos involves various steps: \n1. Identifying the service: Use network scanning tools like Nmap to find the Kerberos service.\n2. Enumeration: Extract valuable information such as usernames using tools like Kerbrute.\n3. Exploitation: Perform attacks such as Pass-the-Ticket or Kerberoasting to gain unauthorized access.\n4. Post-Exploitation: After gaining access, further exploit the system to escalate privileges or exfiltrate data.

⏳ When ?

Kerberos was developed in the 1980s at MIT as part of the Athena Project. It has since become a standard protocol for network authentication, especially in Windows-based environments.

⚙️ Technical Explanations

Kerberos is a network authentication protocol designed to provide secure authentication for client-server applications. The protocol depends on a Key Distribution Center (KDC), which comprises of two components: the Authentication Server (AS) and the Ticket Granting Server (TGS).

When a client needs to access a service, it sends a request to the AS. The AS responds by issuing a Ticket Granting Ticket (TGT), which is encrypted with a key that is derived from the user's password. This TGT is presented by the client to the TGS, which in turn, issues a service ticket. The service ticket gives the client the authorization to access the desired service.

This process, while secure, has vulnerabilities that can be exploited. For instance, an attacker can perform a 'Pass the Ticket' attack. In this scenario, the attacker steals a ticket and replays it to gain unauthorized access. This is possible because Kerberos tickets are not bound to a specific session and can be used from any workstation.

Another type of attack is 'Kerberoasting', where an attacker exploits the fact that the TGT is encrypted with a key derived from the user's password. The attacker requests a service ticket for any service with a registered Service Principal Name (SPN) and cracks the ticket offline to reveal the user's password.

In addition to these, Kerberos can also be susceptible to other forms of attacks such as Golden Ticket and Silver Ticket attacks, which involve the creation of forged Kerberos Ticket Granting Tickets (TGTs) and service tickets, respectively.

Therefore, understanding Kerberos and its vulnerabilities is crucial, especially for network administrators and cybersecurity professionals. Regularly updating and patching the Kerberos system, monitoring network traffic for suspicious activity, and using strong, complex passwords can mitigate some of these vulnerabilities.

For example, let's consider a simplified scenario of a 'Pass the Ticket' attack:

1. Ticket Theft: An attacker has gained access to a workstation and uses a tool like Mimikatz to extract the ticket: mimikatz.exe "privilege::debug" "sekurlsa::tickets /export"

   This command exports all Kerberos tickets present on the system.

2. Ticket Use: The attacker then imports the stolen ticket into their own session using: mimikatz.exe "kerberos::ptt <ticket.kirbi>"

   This command allows the attacker to impersonate the user associated with the stolen ticket.

3. Access Service: The attacker can now access services that the user is authorized to use. For example, if the ticket was for a file server, the attacker could access: \\\\fileserver\\share

For a 'Kerberoasting' attack:

1. Request Service Ticket: An attacker requests a service ticket for a service with a registered SPN: setspn -Q */*

   This command lists all services with an SPN.

2. Export Ticket: The attacker then exports the ticket to a file using Mimikatz: mimikatz.exe "kerberos::golden /domain:domain.local /sid:S-1-5-21-111111111-222222222-333333333 /user:User /krbtgt:1122334455667788 /ticket:ticket.kirbi"

   This command generates a golden ticket for the user.

3. Crack Ticket: The attacker uses a password cracking tool like John the Ripper to crack the ticket offline and reveal the user's password.

While these examples use specific tools and commands, the actual process may vary depending on the exact network configuration and security measures in place. These examples are for educational purposes to understand the vulnerabilities of Kerberos and should not be used for unauthorized activities.