Questions tagged [kerberos]
Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.
152
questions
0
votes
0
answers
85
views
+50
Kerberos protocol attacks?
I have a question in my mind regarding the inner workings of Kerberos protocol. If the generation of the session key is somehow insecure, does this compromise the security of the Kerberos protocol?
I ...
- 43
1
vote
1
answer
90
views
Why do I see LM hashes stored in Active Directory?
I'm using mimikatz to retrieve a user's password hashes from Active Directory with the following command:
lsadump::dcsync /user:mimikatz
The user's password is Pa55w.rd.
The output is
...
Credentials:...
- 364
0
votes
1
answer
48
views
How can a client safely post/get a (symmetric) client key to/from a key distribution center?
If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key ...
0
votes
1
answer
297
views
TGS Ticket in Kerberoasting
In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password.
But in kerberoses authentication process , KRB_TGS_REQ request is ...
1
vote
1
answer
130
views
NFS4+Kerberos: Is the client authenticated?
Imagine the following scenario: A company network with "domain joined" linux clients (e.g they have a HOST$@DOMAIN.LOCAL principal in their keytabs file + A computer entry in the DC).
Now an ...
- 13
0
votes
0
answers
155
views
Kerberos TGT behavior after password change
I just want to confirm behavior of Kerberos and how the tickets work, as I only have a basic understanding. From what it sounds like, the user's password hash is only used to gain the initial TGT. ...
1
vote
1
answer
67
views
Why is the authentication server needed in the Kerberos protocol
Consider the diagram in https://en.wikipedia.org/wiki/Kerberos_(protocol)#/media/File:Kerberos_protocol.svg depicting the Kerberos protocol.
I'm wondering how the authentication server (AS) is useful.....
- 111
0
votes
1
answer
254
views
Why AD Kerberos uses password hash and not session key for tickets?
There is an attack on Active Directory named "Kerberoasting": https://attack.mitre.org/techniques/T1558/003/
I ask TGS for ticket to access some SPN
Part of this ticket is encrypted with ...
- 308
1
vote
1
answer
794
views
How to extract Kerberos ticket from Wireshark?
I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
- 79
3
votes
1
answer
573
views
Kerberos golden ticket works with DNS only - access denied with IP address
I'm playing with mimikatz kerberos::golden, e.g.,
kerberos::golden /domain:XXX /sid:XXX /user:XXX /aes256:XXX /endin:864000 /renewmax:10240 /ptt
Then I tried to access a domain joined machine, but I ...
- 1,745
0
votes
1
answer
259
views
Kerberos Ticket Granting Service TGS - order of communication steps
Microsoft describes the communication steps to receive a TGS as follows:
client asks Kerberos DC for Ticket Granting Ticket
client receives TGT (if authenticated successfully)
client asks KDC for ...
- 13
2
votes
0
answers
87
views
Are there any security advantages to using Kernel Keyring versus the default file based caches for Kerberos on Linux? [closed]
In a containerized environment, what would be the most appropriate way of configuring Kerberos caches?
- 131
1
vote
1
answer
124
views
How is the initial request made to the Access Server in Kerberos?
I'm trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I've seen say the initial request is partially encrypted ...
- 283
1
vote
1
answer
367
views
How NTLM SSO is preformed on smartcard Kerberos logon?
I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved.
After an interactive logon with kerberos, you will have in the cached credentials both ...
- 33
1
vote
2
answers
258
views
What is a secure way to log onto the domain controller?
On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
- 475
6
votes
2
answers
240
views
Can a Kerberos application server offer to proxy connections to the KDC?
As I understand it, when a client wants to authenticate to an application server using Kerberos it must first request a service ticket from the KDC (and possibly a ticket-granting-ticket if it does ...
- 233
1
vote
1
answer
185
views
Why do administrators create passwords vulnerable to kerberoasting? [closed]
I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
- 13
0
votes
1
answer
129
views
MIT Kerberos: getting keytabs onto hosts securely
When setting up a host (... or updating its keytab if it needs new entries), what's the standard way to set up keytabs?
Looks like the MIT Kerberos docs themselves recommend using ktadmin on the host ...
- 101
2
votes
1
answer
221
views
Is the MIT implementation of Kerberos protocol as vulnerable as the one used by Microsoft?
I am doing some research for school about the Kerberos protocol and its vulnerabilities, especially the Pass the Ticket attack.
Related articles are always talking about Active Directory so I was ...
- 21
1
vote
1
answer
3k
views
Is it possible make a Pass-The-Hash attack with Responder?
The tool Responder written in Python permits to listen on a specific network card requests and automatically poisoning victims the steal hash NTLMv1 and hash NTLMv2.
The attack Pass-The-Hash permits ...
- 274
0
votes
1
answer
250
views
Kerberos - obtaining the krbtgt's secret in order to perform Golden Ticket attack
As far as I know, in order to create a Golden Ticket, the attacker needs to obtain the krbtgt's password's hash, which is not a trivial task. My question is: is it possible to find the krbtgt's ...
3
votes
2
answers
741
views
User authentication: In HTTP Server vs. in Web Application
Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
- 140
1
vote
1
answer
158
views
What exactly could we get as an attacker if Kerberos Pre-Authentication is disabled?
I'm learning about how Kerberos and it's common exploits work and I'm a little confused. In this video explaining the process we see that at one of the earlier points the user is provided with two ...
- 33
0
votes
1
answer
331
views
Is it possible to use Kerberos for SSO in a SaaS application?
If I have a webapplication in my internal Microsoft Windows network I'm aware that I can use the kerberos protocol to make a Single Sign on (SSO) into this application with the web browser.
Is it a ...
- 103
1
vote
2
answers
192
views
NTLM Modern usage
I understand that Kerberos is the recent authentication protocol used in windows environment and that NTLM is still supported for interoperability only.
I want to know in non domain environments,if i ...
- 11
0
votes
1
answer
230
views
Is kerberos unconstrained delegation partially safer than constrained delegation?
When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
- 161
12
votes
1
answer
2k
views
Are there any reasons for Kerberos being based on symmetric cryptography?
Kerberos is an authentication protocol that is famously built using only symmetric ciphers.
As a direct result of this, there are several attacks possible, such as
AS-REP Roasting
AS-REQ Roasting
...
user163495
1
vote
1
answer
1k
views
Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain
Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
0
votes
1
answer
314
views
Does Kerberos authentication handle DNS names the same way between Windows 7 and Windows 10?
Recently, we migrated from Windows 7 to Windows 10 and during that migration, we progressively ran into some issues with our NAS device. To be more precise, we progressively noticed some tcp socket ...
- 181
2
votes
0
answers
113
views
Caching TGT from a browser
I'm playing around with Kerberos SSO. As experimented so far,
When I open a web app that is configured with Kerberos, from the browser, it prompts me for the username and credential, once I enter, I'...
2
votes
1
answer
381
views
How does the browser know windows logged in user id or Kerberos TGT?
My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
- 157
3
votes
1
answer
2k
views
Browser not generating kerberos ticket
Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev
So, I have the following scenario:
A suite of webapps which use kerberos ...
- 83
1
vote
1
answer
140
views
Kerberos over http documentation
The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a
Where is the Kerberos over HTTP official ...
- 73
0
votes
1
answer
595
views
How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?
The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
- 445
1
vote
0
answers
467
views
How to decode kerberos tickets on wireshark? [closed]
It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark.
For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
1
vote
0
answers
189
views
Does kerberos support a grace period in password changes?
The principles are programs instead of human. I want to rotate their password regularly, using random generated password, and then deliver the new password to the programs. I have a mechanism to make ...
- 61
3
votes
2
answers
144
views
Is SQL auth over windows auth a red flag?
I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
- 31
1
vote
1
answer
163
views
Is there any existing attempted implementation of GSS-API/SPNEGO/GSS-SPNEGO for anything other than Kerberos / NTLM?
I'm aware that SPNEGO is de-facto only used in the wild for Kerberos or NTLM. Is there any research / academic / educational example on how it can be also used for other mechanisms as well?
- 851
1
vote
1
answer
797
views
Kerberos Encryption and Decryption
Hacker is able to sniff the traffic between the editor, the KDC and the network scanner during the key exchange. Is he/she able to decrypt the sniffed data key?
0
votes
1
answer
130
views
Kerberos Authentication : Client authentication only
I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos".
I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
- 416
0
votes
1
answer
630
views
Bruteforcing via port 88 on MacOS
Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how?
If the vncserver is active, it is possible to know also the username (by ...
1
vote
0
answers
128
views
How much time is needed for bruteforce kerberos/ntlm? [closed]
How much time does an attacker need for full bruteforce on typical complexity password policy given either:
kerberos ticket/ as req or
Ntlm transaction
This depends on the algorithm used (rc4/aes).
...
- 111
0
votes
0
answers
440
views
In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?
When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
2
votes
1
answer
2k
views
How to retrieve Kerberos Service tickets?
I am learning Kerberoasting see below are my steps that I am following.
Step:1. Attacker will find the SPN's
Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
0
votes
0
answers
131
views
What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?
During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
- 445
0
votes
1
answer
141
views
Is there a replay cache in Kerberos 4?
Does Kerberos version 4 support replay cache like in V5 - a cache that prevents replay attacks which occur within the clock skew, so the TGS knows a duplicate packet has arrived ?
- 111
1
vote
1
answer
366
views
Kerberos replay attack within allowed range - authenticator won't prevent it?
In kerberos protocol the client, after receiving a ticket to the TGS server, sends a request to the TGS and adds an authenticator to the request.
What if an attacker performs a replay attack within ...
- 31
1
vote
0
answers
662
views
Use Kerberos Golden Ticket with Metasploit
Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
- 399
0
votes
0
answers
103
views
Why Realm_tgs is needed in Kerberos v5 Protocol? (Step 2)
In msg.2 the AS sends Realm_c, ID_c Ticket_tgs, K_c-tgs, times, N1, Real_tgs, ID_tgs encrypted with E_k_c.
I can't understand why Real_tgs is included if AS and TGS are on the same machine.
- 1
1
vote
1
answer
2k
views
How to crack AES-based Kerberos TGS tickets (Kerberoasting)?
All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password.
However, I want to attempt to crack AES-based Kerberos ...
- 1,157