Questions tagged [kerberos]

Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.

Filter by
Sorted by
Tagged with
0
votes
1answer
187 views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
0
votes
0answers
21 views

How to obtain Service Tickets (TGS) for Service Accounts with no SPNs (ServicePrincipalName) set?

The first step in a kerberoasting attack is to discover Service Accounts via AD enumeration. One way to do so is searching LDAP for any registered SPNs (Service Principal Names). However, from my ...
0
votes
1answer
597 views

Password reset for AD RODC-specific krbtgt_xxxxx accounts

While there's a lot of information [1], [2], [3] about resetting the password for the regular krbtgt account, but I haven't yet found a clear suggestion about RODC-specific krbtgt_xxxxx accounts. ...
0
votes
1answer
65 views

Kerberos Encryption and Decryption

Hacker is able to sniff the traffic between the editor, the KDC and the network scanner during the key exchange. Is he/she able to decrypt the sniffed data key?
1
vote
0answers
51 views

How to decode kerberos tickets on wireshark?

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
3
votes
2answers
86 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
1
vote
0answers
65 views

Does kerberos support a grace period in password changes?

The principles are programs instead of human. I want to rotate their password regularly, using random generated password, and then deliver the new password to the programs. I have a mechanism to make ...
1
vote
1answer
59 views

Is there any existing attempted implementation of GSS-API/SPNEGO/GSS-SPNEGO for anything other than Kerberos / NTLM?

I'm aware that SPNEGO is de-facto only used in the wild for Kerberos or NTLM. Is there any research / academic / educational example on how it can be also used for other mechanisms as well?
0
votes
1answer
36 views

Kerberos Authentication : Client authentication only

I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos". I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
0
votes
2answers
786 views

2FA using Kerberos and SSO within CDE

I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also, what does PCI DSS say about SSO once 2FA has occurred through a Radius Server?
1
vote
0answers
50 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
1
vote
0answers
26 views

How much time is needed for bruteforce kerberos/ntlm?

My question is simply how much time an attacker needs for full bruteforce on typical complexity password policy given either kerberos ticket/ as req or Ntlm transaction. This depends on the ...
1
vote
1answer
65 views

Kerberos replay attack within allowed range - authenticator won't prevent it?

In kerberos protocol the client, after receiving a ticket to the TGS server, sends a request to the TGS and adds an authenticator to the request. What if an attacker performs a replay attack within ...
0
votes
0answers
30 views

In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?

When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
1
vote
0answers
35 views

How to retrieve Kerberos Service tickets?

I am learning Kerberoasting see below are my steps that I am following. Step:1. Attacker will find the SPN's Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
0
votes
0answers
46 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
1
vote
1answer
184 views

Kerberos composite authentication that reflects user's origin

I'm experimenting with Kerberos and was wondering if some sort of composite authentication that identifies both a user and the origin of the users request was a) possible and b) implemented anywhere....
0
votes
1answer
836 views

A replay attack was detected (4649) & Exchange Healthmailbox

We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log. I know Exchange Server ...
0
votes
1answer
64 views

Is there a replay cache in Kerberos 4?

Does Kerberos version 4 support replay cache like in V5 - a cache that prevents replay attacks which occur within the clock skew, so the TGS knows a duplicate packet has arrived ?
6
votes
2answers
1k views

How secure is Kerberos?

I recently got interested about Kerberos and Radius, and I already found some information about their difference. But, I got curious about how secure Kerberos actually is. I see from the official ...
1
vote
0answers
89 views

Use Kerberos Golden Ticket with Metasploit

Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
0
votes
0answers
45 views

Why Realm_tgs is needed in Kerberos v5 Protocol? (Step 2)

In msg.2 the AS sends Realm_c, ID_c Ticket_tgs, K_c-tgs, times, N1, Real_tgs, ID_tgs encrypted with E_k_c. I can't understand why Real_tgs is included if AS and TGS are on the same machine.
2
votes
1answer
78 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
2
votes
1answer
204 views

Can Kerberos encrypt network traffic between servers?

Working in a coporate environment, which uses Active Directory, I overheard someone making a comment stated the Kerberos protcol can be used to encrypt network traffic between Windows servers. Can ...
4
votes
0answers
135 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...
2
votes
2answers
237 views

Kerberos unconstrained delegation for user

I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
-1
votes
1answer
60 views

What are the flaws in this security protocol between client and server? [closed]

Here is my security protocol for the use of a service provided by server. It utilises a symmetric key: Client requests to use a service Server sends back nonce Client sends back nonce encrypted with ...
9
votes
2answers
8k views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
1
vote
0answers
34 views

Questions regarding pass the ticket

In the blackhat talk by Gentikwiki on Mimikatz back in 2014, he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied. Passing the ...
1
vote
0answers
37 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
0answers
18 views

Why the need for user ID in ticket AND authenticator (Kerberos)?

I am currently learning about Kerberos. Why the following in Kerberos v4: Client -> Service : Ticket_Service || Authenticator_Client where Ticket_Service: E(K_S, [K_C,S || ID_C || ...]) and ...
0
votes
0answers
116 views

Mimikatz /rc4 argument for pass-the-ticket?

I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets. The command usually takes the form (Golden tickets): kerberos::golden /sid:SID /domain:DOMAIN /...
2
votes
1answer
163 views

Kerberos three transactions — why not just use two?

I have read the description of Kerberos at sites like this very informative one: http://www.roguelynn.com/words/explain-like-im-5-kerberos/ I think I understand generally how it works: User ...
0
votes
1answer
101 views

Risks for implementing single sign on

I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
0
votes
1answer
350 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
1
vote
0answers
441 views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
36
votes
5answers
14k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
1
vote
0answers
98 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
2
votes
0answers
34 views

How to update authorization information in a KDC dynamically?

I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions. As far as I know, the KDC ...
0
votes
1answer
61 views

Does Windows Authentication Use Secured Connection

I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS ...
1
vote
0answers
672 views

Kerberos and brute-force attacks

Suppose that I am the administrator of a system that uses Kerberos and password authentication. How can I make brute-force attacks on user’s passwords by an attacker who can capture network traffic ...
2
votes
1answer
627 views

Kerberos ticket lifetime

I was just reading up on Kerberos and realized that the lifetime of a master ticket called the TGT(ticket granting ticket) is 25 hours. Is there any particular reason behind this choice of lifetime?
2
votes
0answers
620 views

Web API authentication with Kerberos

We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
2
votes
1answer
81 views

Does Kerberos support vendor specific attributes?

As the question title says: Does Kerberos support vendor specific attributes allowing access segmentation within a given client device?
0
votes
2answers
577 views

Windows Active Directory: How do endpoints authenticate the Domain Controller?

Windows Active Directory is based on Kerberos and LDAP. When authenticating via the Domain Controller, how does my endpoint know that it's really speaking to the DC? Likewise, AD can be used to ...
1
vote
1answer
2k views

Kerberos: kadmin.local: No such file or directory while initializing kadmin.local interface (cloudera quickstart) [closed]

I am running (as sudo) a script for setting up Kerberos (which I will paste below) on a CentOS machine (in a Cloudera Quickstart Docker container). The strange thing is that I have successfully ran ...
21
votes
2answers
38k views

Kerberos vs. LDAP for authentication — which one is more secure

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? And Can we switch between them transparently?
4
votes
1answer
585 views

cracking krb5 passwords (des3-hmac-sha1 and des-cbc-crc ) [closed]

I'm trying to audit kerberos passwords. The available formats are des3-hmac-sha1 and des-cbc-crc but I cannot find a possibility/a tool to crack them. For other hash-types I used John the Ripper, but ...
2
votes
1answer
355 views

On NFSv4 with kerberos security

When NFSv4 is configured to use kerberos authentication is mandatory to have a keytab installed on every client with is own principal. To access files a user still needs to be authenticated with his ...
0
votes
2answers
337 views

Would it be possible to store Kerberos tickets on a YubiKey?

Kerberos supports different ways (ccache types) of storing tickets, such as: FILE MEMORY KEYRING I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...