On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database server which allowed us to steal the ticket, pass-the-ticket and log onto the domain controller. The logon type was remoteinteractive which suggests that a user from SQLDB01 made a RDP session to DC01. In terms of recommendation, I believe restricted admin mode does not protect against this attack as this protection just forces kerberos ticket to default.

  1. What other recommendations are there?
  2. Use credential guard to protect against dumping of kerberos tickets (?)
  3. What is the correct/secure way to log onto the DC? I assume a jumpbox?

As your explanation, It is looks like a common issue in kerberos. It is call golden ticket attack.

You can take following step to mitigate risk of this vulnerability.

  1. Use Least privilege mode
  2. Limit Administrator access.
  3. Use Administrator Account for Limited and required changes only.
  4. Use End-point protection to mitigate attacks
  5. Adding Additional Layer of Security to domain Controller. - You can configure terminal server and allow access to dc only from that particular server.
  6. Based on Requirement you can decide kerberos ticket life time.
  7. Server hardening with appropriate security policies , patches...etc.
  8. Use Detection tool for further security.
  9. Configure Host firewall such as windows Firewall.
  10. Block internet access and internet browsing from Domain controllers.
  11. Use Secured Domain management to avoid login to DC.
  • These are very high level points that by providing details and context would greatly improve this post. – user2320464 Mar 10 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.