Questions tagged [kerberos]
Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.
32
questions with no upvoted or accepted answers
3
votes
0
answers
280
views
Detect Kerberoasting activity
I am working to detect kerberoasting activity and I am referring this link.
It states that an account cannot be requesting several different service names within a second or two of each other. What is ...
- 43
2
votes
0
answers
82
views
kerberoasting on a standard user domain account
Kerberoasting is an attack against domain service accounts.
I have a custom Windows service written in C#. This service is running on a Windows server. This server is a member of the Active Directory ...
- 49
2
votes
0
answers
144
views
Caching TGT from a browser
I'm playing around with Kerberos SSO. As experimented so far,
When I open a web app that is configured with Kerberos, from the browser, it prompts me for the username and credential, once I enter, I'...
2
votes
0
answers
91
views
How to update authorization information in a KDC dynamically?
I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions.
As far as I know, the KDC ...
- 121
2
votes
0
answers
958
views
Web API authentication with Kerberos
We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
- 121
2
votes
0
answers
129
views
Kerberos Constrained Delegation
I have 4 machines,
one machine with Domain Controller,
one machine with Analysis Services,
one machine with IIS Services,
one machine with the Application
The goal is to open the application and the ...
- 133
1
vote
0
answers
32
views
Why can't a user who is accessing the service on their own behalf find the "long term" keys to decrypt the service ticket and have to use U2U?
I started to study how the U2U mechanism works and got confused. The gist is as follows. When we use U2U the service ticket will be encrypted with the session key KDC of the user-"server". ...
- 11
1
vote
0
answers
49
views
SPNEGO-based Kerberos authentication: Should I create a new security context using `gss_init_sec_context` for every request?
I'm implementing SPNEGO-based Kerberos authentication for a Linux client application for authenticating requests to a Windows IIS server.
I've read RFC4559, which describes how authentication should ...
- 1,227
1
vote
2
answers
484
views
What is a secure way to log onto the domain controller?
On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
- 495
1
vote
1
answer
2k
views
Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain
Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
1
vote
0
answers
259
views
Does kerberos support a grace period in password changes?
The principles are programs instead of human. I want to rotate their password regularly, using random generated password, and then deliver the new password to the programs. I have a mechanism to make ...
- 61
1
vote
1
answer
1k
views
Kerberos Encryption and Decryption
Hacker is able to sniff the traffic between the editor, the KDC and the network scanner during the key exchange. Is he/she able to decrypt the sniffed data key?
1
vote
0
answers
727
views
Use Kerberos Golden Ticket with Metasploit
Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
- 409
1
vote
1
answer
3k
views
How to crack AES-based Kerberos TGS tickets (Kerberoasting)?
All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password.
However, I want to attempt to crack AES-based Kerberos ...
- 1,227
1
vote
0
answers
136
views
Questions regarding pass the ticket
In the blackhat talk by Gentikwiki on Mimikatz back in 2014,
he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied.
Passing the ...
- 51
1
vote
0
answers
103
views
Kerberos Protocol Centralized Server
If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
- 131
1
vote
0
answers
85
views
Why the need for user ID in ticket AND authenticator (Kerberos)?
I am currently learning about Kerberos.
Why the following in Kerberos v4:
Client -> Service : Ticket_Service || Authenticator_Client
where Ticket_Service: E(K_S, [K_C,S || ID_C || ...])
and ...
- 13
1
vote
0
answers
1k
views
How do I lookup the UID of a domain user?
I'm playing with golden ticket (mimikatz)
kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
- 2,057
1
vote
0
answers
330
views
LDAPS needed when using Kerberos?
In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC.
Since ...
- 11
1
vote
0
answers
988
views
Kerberos and brute-force attacks
Suppose that I am the administrator of a system that uses Kerberos and password authentication. How can I make brute-force attacks on user’s passwords by an attacker who can capture network traffic ...
- 879
1
vote
0
answers
5k
views
Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes
I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting:
...
- 11
1
vote
0
answers
231
views
In kerberos will a key for a host prinicpal work if the keytab containing the key is stored somewhere inaccessible to that host?
I'm following the instructions here:
https://www.freeipa.org/page/Windows_authentication_against_FreeIPA
to try to allow a Windows machine to authenticate logins against a FreeIPA server on RHEL. I'...
- 11
1
vote
0
answers
128
views
What are some scenarios I would use MSFT Certificate Enrollment Web Services?
The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds.
When setting this up, I ...
- 50.9k
1
vote
0
answers
149
views
How to get Service_key and the corresponding function call interface from the Samba source TGS_REP part
1, My existing configuration environment are as follows: (1), Server_side, Redhat5.5 Enterprise with samba4.0.0 installed, Ip Address: 5.5.5.149; domain name: EXAMPLE.COM; (2), Client_side: windows ...
- 11
0
votes
1
answer
131
views
Shadow Credentials attack with TGT and TGS
I am trying to replicate Shadow Credentials attack in Active Directory environment. My initial approach was to:
Use Whisker to create a new certificate on behalf of DC (successful):
Whisker.exe add /...
- 101
0
votes
0
answers
72
views
simulating a domain user logon on machine startup
I'm currently working on a lab for AD penetration testing and want some of the machines to have a logon, including the TGT, for a specific domain user cached. So far I couldn't come up with anything ...
- 1
0
votes
0
answers
390
views
Is it possible to get krbtgt hash from TGT ticket?
As you know, during a kerberoasting attack, we can intercept the TGS ticket and use brute force tools (john the ripper, hashcat) to find out the password of the service accounts that signed the TGS ...
0
votes
1
answer
523
views
How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?
It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
- 101
0
votes
1
answer
348
views
Is kerberos unconstrained delegation partially safer than constrained delegation?
When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
- 171
0
votes
0
answers
555
views
In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?
When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
0
votes
0
answers
256
views
What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?
During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
- 445
0
votes
0
answers
127
views
Why Realm_tgs is needed in Kerberos v5 Protocol? (Step 2)
In msg.2 the AS sends Realm_c, ID_c Ticket_tgs, K_c-tgs, times, N1, Real_tgs, ID_tgs encrypted with E_k_c.
I can't understand why Real_tgs is included if AS and TGS are on the same machine.
- 1