88tcp/udp - Pentesting Kerberos

Reading time: 6 minutes

Basic Information

Kerberos는 리소스 접근을 직접 관리하지 않으면서 사용자를 인증하는 원칙으로 동작합니다. 이 점은 프로토콜이 보안 프레임워크에서 맡는 역할을 강조하는 중요한 구별입니다.

In environments like Active Directory, Kerberos is instrumental in establishing the identity of users by validating their secret passwords. This process ensures that each user's identity is confirmed before they interact with network resources. However, Kerberos does not extend its functionality to evaluate or enforce the permissions a user has over specific resources or services. Instead, it provides a secure way of authenticating users, which is a critical first step in the security process.

After authentication by Kerberos, the decision-making process regarding access to resources is delegated to individual services within the network. These services are then responsible for evaluating the authenticated user's rights and permissions, based on the information provided by Kerberos about the user's privileges. This design allows for a separation of concerns between authenticating the identity of users and managing their access rights, enabling a more flexible and secure approach to resource management in distributed networks.

기본 포트: 88/tcp/udp

PORT   STATE SERVICE
88/tcp open  kerberos-sec

Kerberos를 악용하는 방법을 배우려면 Active Directory.

Kerberos-only 환경: 클라이언트 준비 및 문제해결

When NTLM is disabled on domain services (SMB/WinRM/etc.), you must authenticate with Kerberos. Common pitfalls and a working workflow:

• Time synchronization is mandatory. If your host clock is skewed by more than a few minutes you will see KRB_AP_ERR_SKEW and all Kerberos auth will fail. Sync against the DC:

# quick one-shot sync (requires sudo)
sudo ntpdate <dc.fqdn> || sudo chronyd -q 'server <dc.fqdn> iburst'

• 대상 realm/domain에 대한 유효한 krb5.conf를 생성하세요. netexec (CME fork)는 SMB 테스트 중에 이를 출력해줄 수 있습니다:

# Generate krb5.conf and install it
netexec smb <dc.fqdn> -u <user> -p '<pass>' -k --generate-krb5-file krb5.conf
sudo cp krb5.conf /etc/krb5.conf

• TGT를 얻고 ccache를 확인:

kinit <user>
klist

• Kerberos를 SMB tooling과 함께 사용(비밀번호가 전송되지 않음, ccache 사용):

# netexec / CME
netexec smb <dc.fqdn> -k            # lists shares, runs modules using Kerberos
# impacket examples also support -k / --no-pass to use the ccache
smbclient --kerberos //<dc.fqdn>/IPC$

• GSSAPI SSH single sign-on (OpenSSH에서 Windows OpenSSH server로):

# Ensure krb5.conf is correct and you have a TGT (kinit)
# Use the FQDN that matches the host SPN. Wrong names cause: "Server not found in Kerberos database"
ssh -o GSSAPIAuthentication=yes <user>@<host.fqdn>

팁:

• SSH/SMB로 접속할 정확한 FQDN을 /etc/hosts가 해석하도록 설정하고, DNS를 오버라이드하는 경우 이 항목이 베어 도메인 항목보다 먼저 오도록 하세요. SPN 불일치는 GSSAPI를 깨뜨립니다.
• SMB에서 NTLM이 비활성화된 경우 NTLM 시도 시 STATUS_NOT_SUPPORTED가 표시될 수 있습니다; Kerberos를 강제하려면 -k를 추가하세요.

추가

Shodan

• port:88 kerberos

MS14-068

MS14-068 취약점은 공격자가 정당한 사용자의 Kerberos 로그인 토큰을 변조하여 Domain Admin 같은 권한 상승을 허위로 주장하게 할 수 있습니다. 이러한 위조된 주장은 Domain Controller에 의해 잘못 검증되어 Active Directory 포리스트 전반의 네트워크 리소스에 대한 무단 접근을 허용합니다.

Kerberos Vulnerability in MS14-068 (KB3011780) Explained – Active Directory & Azure AD/Entra ID Security

Other exploits: https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek

References

• NetExec (CME) wiki – Kerberos and krb5.conf generation
• OpenSSH GSSAPIAuthentication
• MIT Kerberos – Using Kerberos on UNIX
• 0xdf – HTB: TheFrizz

HackTricks 자동 명령

Protocol_Name: Kerberos    #Protocol Abbreviation if there is one.
Port_Number:  88   #Comma separated if there is more than one.
Protocol_Description: AD Domain Authentication         #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for Kerberos
Note: |
Kerberos operates on a principle where it authenticates users without directly managing their access to resources. This is an important distinction because it underlines the protocol's role in security frameworks.
In environments like **Active Directory**, Kerberos is instrumental in establishing the identity of users by validating their secret passwords. This process ensures that each user's identity is confirmed before they interact with network resources. However, Kerberos does not extend its functionality to evaluate or enforce the permissions a user has over specific resources or services. Instead, it provides a secure way of authenticating users, which is a critical first step in the security process.

https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-kerberos-88/index.html

Entry_2:
Name: Pre-Creds
Description: Brute Force to get Usernames
Command: nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm="{Domain_Name}",userdb={Big_Userlist} {IP}

Entry_3:
Name: With Usernames
Description: Brute Force with Usernames and Passwords
Note: consider git clone https://github.com/ropnop/kerbrute.git ./kerbrute -h

Entry_4:
Name: With Creds
Description: Attempt to get a list of user service principal names
Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs