It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details.

My guess is that usually they assume it's basic knowledge and sometimes, they just don't know enough.

Anyway, here are the questions:

  • How is PtT (Pass the Ticket) possible? You can easily take someone's ticket but to use it you need to create an Authenticator, which means you need to get one of the keys that the client possess (it depends on which step you are in) and even forge the IP address embedded in the ticket stolen.

  • It does not sound reasonable to me that given access to client's computer memory, you would extract only Kerberos tickets and no session keys or clear text/hashed passwords.

  • If only Kerberos is used, where am I going to find any NTLM hash to commit OPtH (Over-Pass the Hash)?

  • The encryption of RC4_HMAC_MD4 is not used by default in nowadays windows operation systems, so how would I use NTLM hash in OPtH? Is downgrade the answer?

  • I read in some article, that kerberoast's brute-force phase is done by trying different NTLM hashes. It seemed weird, so I assumed that it is done by trying clear text passwords which will be used to generate NTLM hashes which will be used in their turn as keys in order to try decrypt the ticket's encryption. But that's not suppose to be the case, RC4_HMAC_MD4 is not used by default. AES does, and it has PBKDF2 as a hash algorithm (which suppose to be BF resistant).

  • How is Silver Ticket is done when the victim sever does check the PAC against the DC?

  • Golden Ticket attack builds on the TGS to cooperate with any given TGT? Which means that it will sign on the PAC even if its forged?

Thank you all.

  • 1
    Welcome to security.SE. Great question! I'm tempted to say this is too broad to be answered in this Q&A format, however all your questions are precise and to-the-point, so ... great question +1 – Mike Ounsworth Dec 24 '18 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.