Edit

Kerberos

Info

How it works

Step 1

Step 2

Step 3

Step 4

Step 5

Bruteforcing

Requirements: connection with DC/KDC.

Linux (external)

With kerbrute.py:

Windows (internal)

With Rubeus version with brute module:

ASREPRoast

Cracking users password, with KRB_AS_REQ when user has DONT_REQ_PREAUTH attribute, KDC respond with KRB_AS_REP user hash and then go for cracking.

Linux (external)

With Impacket example GetNPUsers.py:

Windows (internal)

With Rubeus:

Cracking with dictionary of passwords:

Kerberoasting

Cracking users password from TGS, because TGS requires Service key which is derived from NTLM hash

Linux (external)

With Impacket example GetUserSPNs.py:

Windows (internal)

With Rubeus:

With Powershell:

Cracking with dictionary of passwords:

Overpass The Hash/Pass The Key (PTK)

NTDS.DIT, SAM files or lsass with mimi

Linux (external)

By using Impacket examples:

Windows (internal)

With Rubeus and PsExec:

Pass The Ticket (PTT)

MiTM, lsass with mimi

Linux (external)

Check type and location of tickets:

If none return, default is FILE:/tmp/krb5cc_%{uid}.

In case of file tickets, you can copy-paste (if you have permissions) for use them.

In case of being KEYRING tickets, you can use tickey to get them:

Windows (internal)

With Mimikatz:

With Rubeus in Powershell:

To convert tickets between Linux/Windows format with ticket_converter.py:

Using ticket in Linux

With Impacket examples:

Using ticket in Windows

Inject ticket with Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Silver ticket

Build a TGS with Service key

Linux (external)

With Impacket examples:

Windows (internal)

With Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Golden ticket

Build a TGT with NTLM hash and krbtgt key, valid until krbtgt password is changed or TGT expires

Tickets must be used right after created

Linux (external)

With Impacket examples:

Windows (internal)

With Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Misc

To get NTLM from password:

Delegation

Allows a service impersonate the user to interact with a second service, with the privileges and permissions of the user

  • If a user has delegation capabilities, all its services (and processes) have delegation capabilities.

  • KDC only worries about the user who is talking to, not the process.

  • Any process belonging to the same user can perform the same actions in Kerberos, regardless of whether it is a service or not.

  • Unable to delegate if NotDelegated (or ADS_UF_NOT_DELEGATED) flag is set in the User-Account-Control attribute of the user account or user in Protected Users group.

Unconstrained delegation

  1. User1 requests a TGS for ServiceZ, of UserZ.

  2. The KDC checks if UserZ has the TrustedForDelegation flag set (Yes).

  3. The KDC includes a TGT of User1 inside the TGS for ServiceZ.

  4. ServiceZ receives the TGS with the TGT of User1 included and stores it for later use.

Contrained delegation and RBCD (Resource Based Constrained Delegation)

Delegation is constrained to only some whitelisted third-party services.

  • S4U2Proxy Contrained

  • S4U2Proxy RBCD

  • S4U2Proxy Service Name Change

  • S4U2Self

  • S4U2Self & S4U2Proxy combined Contrained

  • S4U2Self & S4U2Proxy combined RBCD

  • RBCD attack

LogoGitHub - tothi/rbcd-attack: Kerberos Resource-Based Constrained Delegation Attack from Outside using ImpacketGitHub

PreviousADNextPS tips & tricks

Last updated

Was this helpful?