Questions tagged [kerberos]
Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.
134
questions
0
votes
1answer
44 views
Kerberos - obtaining the krbtgt's secret in order to perform Golden Ticket attack
As far as I know, in order to create a Golden Ticket, the attacker needs to obtain the krbtgt's password's hash, which is not a trivial task. My question is: is it possible to find the krbtgt's ...
1
vote
1answer
133 views
Bruteforcing via port 88 on MacOS
Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how?
If the vncserver is active, it is possible to know also the username (by ...
2
votes
2answers
216 views
Kerberos composite authentication that reflects user's origin
I'm experimenting with Kerberos and was wondering if some sort of
composite authentication that identifies both a user and the origin of the users request was a) possible and b) implemented
anywhere....
0
votes
0answers
4 views
Why Kerberos protocol defines two servers? [migrated]
If someone can implement the all the functionalities that Authorization server and Ticket Granting Server in one server, why not do it?
0
votes
1answer
82 views
Is kerberos unconstrained delegation partially safer than constrained delegation?
When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
0
votes
1answer
821 views
How to crack AES-based Kerberos TGS tickets (Kerberoasting)?
All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password.
However, I want to attempt to crack AES-based Kerberos ...
1
vote
1answer
947 views
Password reset for AD RODC-specific krbtgt_xxxxx accounts
While there's a lot of information [1], [2], [3] about resetting the password for the regular krbtgt account, but I haven't yet found a clear suggestion about RODC-specific krbtgt_xxxxx accounts.
...
1
vote
1answer
219 views
Kerberos Encryption and Decryption
Hacker is able to sniff the traffic between the editor, the KDC and the network scanner during the key exchange. Is he/she able to decrypt the sniffed data key?
0
votes
1answer
353 views
Manually creating computer account and SPN's in Kerberos (krb5) keytab file for Window Active Directory domain
Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using "realmd", some using samba and so forth. Others describe how you can do things ...
0
votes
1answer
2k views
A replay attack was detected (4649) & Exchange Healthmailbox
We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log.
I know Exchange ...
3
votes
2answers
263 views
User authentication: In HTTP Server vs. in Web Application
Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
0
votes
0answers
35 views
Kerberos tickets for service accounts and NFSv4 id mapping
I have a Synology NAS that I'm trying to access over NFS from a couple of systems running archlinux (a laptop and a server). I'd like to get NFSv4 id mapping working so that I don't have to align the ...
1
vote
1answer
39 views
What exactly could we get as an attacker if Kerberos Pre-Authentication is disabled?
I'm learning about how Kerberos and it's common exploits work and I'm a little confused. In this video explaining the process we see that at one of the earlier points the user is provided with two ...
8
votes
1answer
233 views
Kerberos Attacks Questions
It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details.
My guess is that usually they assume it's basic knowledge and sometimes, they ...
0
votes
1answer
94 views
Is it possible to use Kerberos for SSO in a SaaS application?
If I have a webapplication in my internal Microsoft Windows network I'm aware that I can use the kerberos protocol to make a Single Sign on (SSO) into this application with the web browser.
Is it a ...
1
vote
1answer
66 views
NTLM Modern usage
I understand that Kerberos is the recent authentication protocol used in windows environment and that NTLM is still supported for interoperability only.
I want to know in non domain environments,if i ...
9
votes
1answer
437 views
Are there any reasons for Kerberos being based on symmetric cryptography?
Kerberos is an authentication protocol that is famously built using only symmetric ciphers.
As a direct result of this, there are several attacks possible, such as
AS-REP Roasting
AS-REQ Roasting
...
1
vote
0answers
49 views
How much time is needed for bruteforce kerberos/ntlm? [closed]
How much time does an attacker need for full bruteforce on typical complexity password policy given either:
kerberos ticket/ as req or
Ntlm transaction
This depends on the algorithm used (rc4/aes).
...
0
votes
1answer
113 views
Does Kerberos authentication handle DNS names the same way between Windows 7 and Windows 10?
Recently, we migrated from Windows 7 to Windows 10 and during that migration, we progressively ran into some issues with our NAS device. To be more precise, we progressively noticed some tcp socket ...
2
votes
0answers
49 views
Caching TGT from a browser
I'm playing around with Kerberos SSO. As experimented so far,
When I open a web app that is configured with Kerberos, from the browser, it prompts me for the username and credential, once I enter, I'...
6
votes
3answers
2k views
How secure is Kerberos?
I recently got interested about Kerberos and Radius, and I already found some information about their difference. But, I got curious about how secure Kerberos actually is.
I see from the official ...
4
votes
1answer
5k views
How does Kerberos protect against replay attacks?
I have been reading about Kerberos, and I understand the messages exchanged, and that it uses symmetric encryption in order to protect some of the messages. But, how does it protect against replay ...
3
votes
1answer
718 views
Browser not generating kerberos ticket
Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev
So, I have the following scenario:
A suite of webapps which use kerberos ...
2
votes
1answer
125 views
How does the browser know windows logged in user id or Kerberos TGT?
My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
1
vote
1answer
63 views
Kerberos over http documentation
The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a
Where is the Kerberos over HTTP official ...
0
votes
1answer
159 views
How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?
The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
1
vote
0answers
198 views
How to decode kerberos tickets on wireshark? [closed]
It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark.
For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
3
votes
2answers
97 views
Is SQL auth over windows auth a red flag?
I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
1
vote
0answers
88 views
Does kerberos support a grace period in password changes?
The principles are programs instead of human. I want to rotate their password regularly, using random generated password, and then deliver the new password to the programs. I have a mechanism to make ...
1
vote
1answer
84 views
Is there any existing attempted implementation of GSS-API/SPNEGO/GSS-SPNEGO for anything other than Kerberos / NTLM?
I'm aware that SPNEGO is de-facto only used in the wild for Kerberos or NTLM. Is there any research / academic / educational example on how it can be also used for other mechanisms as well?
0
votes
1answer
71 views
Kerberos Authentication : Client authentication only
I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos".
I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
0
votes
2answers
1k views
2FA using Kerberos and SSO within CDE
I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also, what does PCI DSS say about SSO once 2FA has occurred through a Radius Server?
1
vote
1answer
174 views
Kerberos replay attack within allowed range - authenticator won't prevent it?
In kerberos protocol the client, after receiving a ticket to the TGS server, sends a request to the TGS and adds an authenticator to the request.
What if an attacker performs a replay attack within ...
0
votes
0answers
145 views
In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?
When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
1
vote
0answers
312 views
How to retrieve Kerberos Service tickets?
I am learning Kerberoasting see below are my steps that I am following.
Step:1. Attacker will find the SPN's
Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
0
votes
0answers
49 views
What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?
During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
0
votes
1answer
71 views
Is there a replay cache in Kerberos 4?
Does Kerberos version 4 support replay cache like in V5 - a cache that prevents replay attacks which occur within the clock skew, so the TGS knows a duplicate packet has arrived ?
1
vote
0answers
393 views
Use Kerberos Golden Ticket with Metasploit
Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
0
votes
0answers
50 views
Why Realm_tgs is needed in Kerberos v5 Protocol? (Step 2)
In msg.2 the AS sends Realm_c, ID_c Ticket_tgs, K_c-tgs, times, N1, Real_tgs, ID_tgs encrypted with E_k_c.
I can't understand why Real_tgs is included if AS and TGS are on the same machine.
2
votes
1answer
137 views
Certificates for autoscaling internal networks?
A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client.
How is the same thing typically implemented on private networks, ...
2
votes
1answer
476 views
Can Kerberos encrypt network traffic between servers?
Working in a coporate environment, which uses Active Directory, I overheard someone making a comment stated the Kerberos protcol can be used to encrypt network traffic between Windows servers. Can ...
2
votes
2answers
437 views
Kerberos unconstrained delegation for user
I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
-1
votes
1answer
61 views
What are the flaws in this security protocol between client and server? [closed]
Here is my security protocol for the use of a service provided by server. It utilises a symmetric key:
Client requests to use a service
Server sends back nonce
Client sends back nonce encrypted with ...
9
votes
2answers
9k views
Preventing LSASS from storing clear-text passwords in Kerberos environment
It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
1
vote
0answers
50 views
Questions regarding pass the ticket
In the blackhat talk by Gentikwiki on Mimikatz back in 2014,
he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied.
Passing the ...
1
vote
0answers
40 views
Kerberos Protocol Centralized Server
If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
0answers
18 views
Why the need for user ID in ticket AND authenticator (Kerberos)?
I am currently learning about Kerberos.
Why the following in Kerberos v4:
Client -> Service : Ticket_Service || Authenticator_Client
where Ticket_Service: E(K_S, [K_C,S || ID_C || ...])
and ...
0
votes
0answers
188 views
Mimikatz /rc4 argument for pass-the-ticket?
I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets.
The command usually takes the form (Golden tickets):
kerberos::golden /sid:SID /domain:DOMAIN /...
3
votes
1answer
259 views
Kerberos three transactions — why not just use two?
I have read the description of Kerberos at sites like this very informative one:
http://www.roguelynn.com/words/explain-like-im-5-kerberos/
I think I understand generally how it works:
User ...
0
votes
1answer
113 views
Risks for implementing single sign on
I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
