Skip to main content

Questions tagged [kerberos]

Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

Opening PowerShell (PS) session with STs

I am solving Tryhackme> Exploiting Active Directory > Task 3. At very last, how new powershell session is opening with the dumped Service Tickets (STs)? He typed this command... PS> New-...
Aryan's user avatar
  • 31
1 vote
0 answers
16 views

Is Kerberos Constrained Delegation (KCD) deprecated?

Referred to the official microsoft documentation on KCD where they are using the terms KCD & Resource Based Constrained Delegation (RBCD) almost interchangeably which got me confused. They have ...
Aryan's user avatar
  • 31
0 votes
1 answer
41 views

In Kerberos, is the "Authentication Server" the only "Trusted Third Party"? Or is "Ticket Granting Server" also a "Trusted Third Party"?

I know that AS (Authentication Server) is a TTP (Trusted Third Party) because it generates keys for two entities (for the client and the TGS). But what about TGS (Ticket Granting Server)? It also ...
allexj's user avatar
  • 129
1 vote
0 answers
57 views

Why can't a user who is accessing the service on their own behalf find the "long term" keys to decrypt the service ticket and have to use U2U?

I started to study how the U2U mechanism works and got confused. The gist is as follows. When we use U2U the service ticket will be encrypted with the session key KDC of the user-"server". ...
Deoni Deon's user avatar
1 vote
0 answers
81 views

Hashed Password Kerberos PKDF2 AES - ActiveDirectory [closed]

I know that in Active Directory environments passwords are stored in the form of hashes depending on encryption types used in the environment. I understand also that when using AES as a symmetric ...
Matías Huartamendía's user avatar
1 vote
0 answers
69 views

SPNEGO-based Kerberos authentication: Should I create a new security context using `gss_init_sec_context` for every request?

I'm implementing SPNEGO-based Kerberos authentication for a Linux client application for authenticating requests to a Windows IIS server. I've read RFC4559, which describes how authentication should ...
Shuzheng's user avatar
  • 1,267
0 votes
1 answer
191 views

Shadow Credentials attack with TGT and TGS

I am trying to replicate Shadow Credentials attack in Active Directory environment. My initial approach was to: Use Whisker to create a new certificate on behalf of DC (successful): Whisker.exe add /...
Teodor Cristian's user avatar
0 votes
1 answer
152 views

How to mitigate spoofing, keylogging password, stealing public key with smart card with external/internal smart card reader?

Here is my thought process: I want to use smartcards without passwords for my setup. We don't want to use Iris or fingerprint or voice. I only want to put in the card whenever something needs to ...
user300431's user avatar
1 vote
1 answer
279 views

Oracle Kerberos authentication on Linux host with SSSD

I have Linux servers which are members of AD domain, running SSSD demon. SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication. NOTE: this is not purely about ...
ibre5041's user avatar
3 votes
2 answers
2k views

Kerberos - NTLM Password Hashes - Questions!

I have worked as a system administrator mainly on Widnows Server for some years now. Over the course of time I've always had a hard time trying to fully understand how Kerberos work. For about 3 weeks ...
Matías Huartamendía's user avatar
2 votes
1 answer
116 views

kerberoasting on a standard user domain account

Kerberoasting is an attack against domain service accounts. I have a custom Windows service written in C#. This service is running on a Windows server. This server is a member of the Active Directory ...
Bob5421's user avatar
  • 51
0 votes
1 answer
666 views

How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?

It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
thomas's user avatar
  • 101
1 vote
1 answer
1k views

Why do I see LM hashes stored in Active Directory?

I'm using mimikatz to retrieve a user's password hashes from Active Directory with the following command: lsadump::dcsync /user:mimikatz The user's password is Pa55w.rd. The output is ... Credentials:...
Daniel's user avatar
  • 364
0 votes
1 answer
130 views

How can a client safely post/get a (symmetric) client key to/from a key distribution center?

If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
hurryman2212's user avatar
1 vote
1 answer
1k views

TGS Ticket in Kerberoasting

In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password. But in kerberoses authentication process , KRB_TGS_REQ request is ...
user10433098's user avatar
1 vote
1 answer
366 views

NFS4+Kerberos: Is the client authenticated?

Imagine the following scenario: A company network with "domain joined" linux clients (e.g they have a [email protected] principal in their keytabs file + A computer entry in the DC). Now an ...
tobi_b's user avatar
  • 13
1 vote
1 answer
165 views

Why is the authentication server needed in the Kerberos protocol

Consider the diagram in https://en.wikipedia.org/wiki/Kerberos_(protocol)#/media/File:Kerberos_protocol.svg depicting the Kerberos protocol. I'm wondering how the authentication server (AS) is useful.....
user2224350's user avatar
0 votes
1 answer
748 views

Why AD Kerberos uses password hash and not session key for tickets?

There is an attack on Active Directory named "Kerberoasting": https://attack.mitre.org/techniques/T1558/003/ I ask TGS for ticket to access some SPN Part of this ticket is encrypted with ...
user996142's user avatar
2 votes
1 answer
3k views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
Bob's user avatar
  • 99
3 votes
1 answer
985 views

Kerberos golden ticket works with DNS only - access denied with IP address

I'm playing with mimikatz kerberos::golden, e.g., kerberos::golden /domain:XXX /sid:XXX /user:XXX /aes256:XXX /endin:864000 /renewmax:10240 /ptt Then I tried to access a domain joined machine, but I ...
daisy's user avatar
  • 2,077
0 votes
1 answer
488 views

Kerberos Ticket Granting Service TGS - order of communication steps

Microsoft describes the communication steps to receive a TGS as follows: client asks Kerberos DC for Ticket Granting Ticket client receives TGT (if authenticated successfully) client asks KDC for ...
MarkHelms's user avatar
2 votes
0 answers
132 views

Are there any security advantages to using Kernel Keyring versus the default file based caches for Kerberos on Linux? [closed]

In a containerized environment, what would be the most appropriate way of configuring Kerberos caches?
sa___'s user avatar
  • 131
1 vote
1 answer
180 views

How is the initial request made to the Access Server in Kerberos?

I'm trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I've seen say the initial request is partially encrypted ...
northerner's user avatar
1 vote
1 answer
701 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
Eran Nahshon's user avatar
1 vote
2 answers
518 views

What is a secure way to log onto the domain controller?

On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
Anderson's user avatar
  • 505
6 votes
2 answers
680 views

Can a Kerberos application server offer to proxy connections to the KDC?

As I understand it, when a client wants to authenticate to an application server using Kerberos it must first request a service ticket from the KDC (and possibly a ticket-granting-ticket if it does ...
9072997's user avatar
  • 243
1 vote
1 answer
270 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
Dmitry's user avatar
  • 13
0 votes
1 answer
252 views

MIT Kerberos: getting keytabs onto hosts securely

When setting up a host (... or updating its keytab if it needs new entries), what's the standard way to set up keytabs? Looks like the MIT Kerberos docs themselves recommend using ktadmin on the host ...
Latanius's user avatar
  • 101
2 votes
1 answer
326 views

Is the MIT implementation of Kerberos protocol as vulnerable as the one used by Microsoft?

I am doing some research for school about the Kerberos protocol and its vulnerabilities, especially the Pass the Ticket attack. Related articles are always talking about Active Directory so I was ...
cleve21's user avatar
  • 21
1 vote
1 answer
4k views

Is it possible make a Pass-The-Hash attack with Responder?

The tool Responder written in Python permits to listen on a specific network card requests and automatically poisoning victims the steal hash NTLMv1 and hash NTLMv2. The attack Pass-The-Hash permits ...
Anonymous's user avatar
  • 274
0 votes
1 answer
550 views

Kerberos - obtaining the krbtgt's secret in order to perform Golden Ticket attack

As far as I know, in order to create a Golden Ticket, the attacker needs to obtain the krbtgt's password's hash, which is not a trivial task. My question is: is it possible to find the krbtgt's ...
DarkClover24's user avatar
3 votes
2 answers
1k views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
Hermann's user avatar
  • 140
1 vote
1 answer
311 views

What exactly could we get as an attacker if Kerberos Pre-Authentication is disabled?

I'm learning about how Kerberos and it's common exploits work and I'm a little confused. In this video explaining the process we see that at one of the earlier points the user is provided with two ...
J_N_300's user avatar
  • 33
0 votes
1 answer
504 views

Is it possible to use Kerberos for SSO in a SaaS application?

If I have a webapplication in my internal Microsoft Windows network I'm aware that I can use the kerberos protocol to make a Single Sign on (SSO) into this application with the web browser. Is it a ...
leo's user avatar
  • 103
1 vote
2 answers
291 views

NTLM Modern usage

I understand that Kerberos is the recent authentication protocol used in windows environment and that NTLM is still supported for interoperability only. I want to know in non domain environments,if i ...
665bassem's user avatar
0 votes
1 answer
374 views

Is kerberos unconstrained delegation partially safer than constrained delegation?

When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
user134167's user avatar
12 votes
1 answer
2k views

Are there any reasons for Kerberos being based on symmetric cryptography?

Kerberos is an authentication protocol that is famously built using only symmetric ciphers. As a direct result of this, there are several attacks possible, such as AS-REP Roasting AS-REQ Roasting ...
user avatar
1 vote
1 answer
2k views

Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain

Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
Johan van Tonder's user avatar
0 votes
1 answer
475 views

Does Kerberos authentication handle DNS names the same way between Windows 7 and Windows 10?

Recently, we migrated from Windows 7 to Windows 10 and during that migration, we progressively ran into some issues with our NAS device. To be more precise, we progressively noticed some tcp socket ...
pmbonneau's user avatar
  • 201
2 votes
0 answers
155 views

Caching TGT from a browser

I'm playing around with Kerberos SSO. As experimented so far, When I open a web app that is configured with Kerberos, from the browser, it prompts me for the username and credential, once I enter, I'...
Kannan Ramamoorthy's user avatar
2 votes
1 answer
643 views

How does the browser know windows logged in user id or Kerberos TGT?

My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
ZEE's user avatar
  • 167
3 votes
1 answer
3k views

Browser not generating kerberos ticket

Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev So, I have the following scenario: A suite of webapps which use kerberos ...
Steven's user avatar
  • 83
2 votes
1 answer
204 views

Kerberos over http documentation

The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a Where is the Kerberos over HTTP official ...
aquaman's user avatar
  • 93
1 vote
1 answer
1k views

How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?

The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
n00b's user avatar
  • 465
1 vote
0 answers
633 views

How to decode kerberos tickets on wireshark? [closed]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
Trigosin Darom's user avatar
1 vote
0 answers
283 views

Does kerberos support a grace period in password changes?

The principles are programs instead of human. I want to rotate their password regularly, using random generated password, and then deliver the new password to the programs. I have a mechanism to make ...
user2828102's user avatar
3 votes
2 answers
211 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
Alex Denton's user avatar
1 vote
1 answer
217 views

Is there any existing attempted implementation of GSS-API/SPNEGO/GSS-SPNEGO for anything other than Kerberos / NTLM?

I'm aware that SPNEGO is de-facto only used in the wild for Kerberos or NTLM. Is there any research / academic / educational example on how it can be also used for other mechanisms as well?
Eran Medan's user avatar
1 vote
1 answer
1k views

Kerberos Encryption and Decryption

Hacker is able to sniff the traffic between the editor, the KDC and the network scanner during the key exchange. Is he/she able to decrypt the sniffed data key?
Amandeep Kaur's user avatar
0 votes
1 answer
174 views

Kerberos Authentication : Client authentication only

I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos". I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
Walfrat's user avatar
  • 416