Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
During an authorized pentest, I found several radius servers and a /etc/raddb/server file that stores shared secret, e.g
10.10.10.10 123456 15
Now what could one do with this "shared secret", perhaps dump the database?
From what I know, this radius server is used together with a krb5 server for authentication, e.g SSH logins
The RADIUS client and server use the shared secret to encrypt the password. If you know the shared secret, and you can capture RADIUS packets with encrypted passwords, you can decrypt them and get the user's unencrypted password.
Wireshark includes the ability to do this, of course:
perhaps dump the database?
No, the shared secret is used to protect things on the wire, not anything on disk or in the database. You'll note that the shared secret you found was specific to a client IP address; a RADIUS server can use a different shared secret for each system it's extending authentication services to... which implies, in turn, that it's not for the back-end password (else you'd need N copies of the back-end password for N shared secrets).
this radius server is used together with a krb5 server for authentication
Usually when a RADIUS server is used with KRB5, it's to extend authentication to dumber devices that don't support Kerberos. So you don't have to worry about Kerberos being tunneled over RADIUS; it's merely providing a down-level front-end to the back-end database that's part of Kerberos. It may do so by speaking RADIUS on one side and Kerberos on the other, but that doesn't change the fact that the RADIUS packets on the wire are vulnerable if you know the shared secret.
If you MITM the connection between e.g. a wifi acces point and the RADIUS server you could then impersonate the Radius to the AP and always answer "yes" whenever the AP asks "Can I let this guy X in?"
