hacktricks/network-services-pentesting/pentesting-kerberos-88

88tcp/udp - Pentesting Kerberos

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

Basic Information

Kerberos inafanya kazi kwa kanuni ambapo inathibitisha watumiaji bila kusimamia moja kwa moja ufikiaji wao kwa rasilimali. Hii ni tofauti muhimu kwa sababu inasisitiza jukumu la itifaki katika mifumo ya usalama.

Katika mazingira kama Active Directory, Kerberos ni muhimu katika kuanzisha utambulisho wa watumiaji kwa kuthibitisha nywila zao za siri. Mchakato huu unahakikisha kwamba utambulisho wa kila mtumiaji unathibitishwa kabla ya kuingiliana na rasilimali za mtandao. Hata hivyo, Kerberos haipanui kazi zake ili kutathmini au kutekeleza ruhusa alizo nazo mtumiaji juu ya rasilimali au huduma maalum. Badala yake, inatoa njia salama ya kuthibitisha watumiaji, ambayo ni hatua muhimu ya kwanza katika mchakato wa usalama.

Baada ya uthibitisho na Kerberos, mchakato wa kufanya maamuzi kuhusu ufikiaji wa rasilimali unakabidhiwa kwa huduma binafsi ndani ya mtandao. Huduma hizi zinawajibika kutathmini haki na ruhusa za mtumiaji aliyethibitishwa, kulingana na taarifa iliyotolewa na Kerberos kuhusu haki za mtumiaji. Muundo huu unaruhusu kutenganisha masuala kati ya kuthibitisha utambulisho wa watumiaji na kusimamia haki zao za ufikiaji, na kuwezesha njia yenye kubadilika na salama ya usimamizi wa rasilimali katika mitandao iliyosambazwa.

Default Port: 88/tcp/udp

PORT   STATE SERVICE
88/tcp open  kerberos-sec

Ili kujifunza jinsi ya kutumia Kerberos unapaswa kusoma chapisho kuhusu Active Directory.

Zaidi

Shodan

• port:88 kerberos

MS14-068

Kasoro ya MS14-068 inaruhusu mshambuliaji kubadilisha token ya kuingia ya Kerberos ya mtumiaji halali ili kudai kwa uwongo mamlaka ya juu, kama vile kuwa Msimamizi wa Domain. Dai hili la uongo linathibitishwa kwa makosa na Msimamizi wa Domain, likiwezesha ufikiaji usioidhinishwa wa rasilimali za mtandao katika msitu wa Active Directory.

{% embed url="https://adsecurity.org/?p=541" %}

Mizaha mingine: https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek

HackTricks Amri za Otomatiki

Protocol_Name: Kerberos    #Protocol Abbreviation if there is one.
Port_Number:  88   #Comma separated if there is more than one.
Protocol_Description: AD Domain Authentication         #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for Kerberos
Note: |
Kerberos operates on a principle where it authenticates users without directly managing their access to resources. This is an important distinction because it underlines the protocol's role in security frameworks.
In environments like **Active Directory**, Kerberos is instrumental in establishing the identity of users by validating their secret passwords. This process ensures that each user's identity is confirmed before they interact with network resources. However, Kerberos does not extend its functionality to evaluate or enforce the permissions a user has over specific resources or services. Instead, it provides a secure way of authenticating users, which is a critical first step in the security process.

https://book.hacktricks.xyz/pentesting/pentesting-kerberos-88

Entry_2:
Name: Pre-Creds
Description: Brute Force to get Usernames
Command: nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm="{Domain_Name}",userdb={Big_Userlist} {IP}

Entry_3:
Name: With Usernames
Description: Brute Force with Usernames and Passwords
Note: consider git clone https://github.com/ropnop/kerbrute.git ./kerbrute -h

Entry_4:
Name: With Creds
Description: Attempt to get a list of user service principal names
Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs

{% hint style="success" %} Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!
• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

{% endhint %}