hacktricks/network-services-pentesting/pentesting-kerberos-88

88tcp/udp - Kupima Udukuzi wa Kerberos

Jifunze udukuzi wa AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

• Ikiwa unataka kuona kampuni yako inayotangazwa katika HackTricks au kupakua HackTricks katika PDF Angalia MPANGO WA KUJIUNGA!
• Pata swag rasmi wa PEASS & HackTricks
• Gundua The PEASS Family, mkusanyiko wetu wa kipekee wa NFTs
• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @carlospolopm.
• Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Taarifa Msingi

Kerberos inafanya kazi kwa kanuni ambapo inathibitisha watumiaji bila kusimamia moja kwa moja ufikiaji wao kwa rasilimali. Hii ni tofauti muhimu kwa sababu inasisitiza jukumu la itifaki katika mifumo ya usalama.

Katika mazingira kama Active Directory, Kerberos ni muhimu katika kuanzisha utambulisho wa watumiaji kwa kuthibitisha nywila zao za siri. Mchakato huu huhakikisha kuwa utambulisho wa kila mtumiaji unathibitishwa kabla ya kuingiliana na rasilimali za mtandao. Walakini, Kerberos haiongezi utendaji wake wa kutathmini au kutekeleza ruhusa ambazo mtumiaji anayo juu ya rasilimali au huduma maalum. Badala yake, inatoa njia salama ya kuthibitisha watumiaji, ambayo ni hatua muhimu sana katika mchakato wa usalama.

Baada ya kuthibitishwa na Kerberos, mchakato wa kufanya maamuzi kuhusu ufikiaji wa rasilimali unatekelezwa na huduma binafsi ndani ya mtandao. Huduma hizi ndizo zinazohusika na kutathmini haki na ruhusa za mtumiaji aliye thibitishwa, kulingana na habari zinazotolewa na Kerberos kuhusu mamlaka ya mtumiaji. Muundo huu unaruhusu kugawanyika kwa majukumu kati ya kuthibitisha utambulisho wa watumiaji na kusimamia haki zao za ufikiaji, kuruhusu njia inayoweza kubadilika na salama zaidi ya usimamizi wa rasilimali katika mtandao uliogawanyika.

Bandari ya Chaguo: 88/tcp/udp

PORT   STATE SERVICE
88/tcp open  kerberos-sec

Ili kujifunza jinsi ya kutumia Kerberos vibaya, unapaswa kusoma chapisho kuhusu Active Directory.

Zaidi

Shodan

• port:88 kerberos

MS14-068

Kosa la MS14-068 linaruhusu mtu kudukua alama ya kuingia ya Kerberos ya mtumiaji halali ili kudai vibali vilivyoinuliwa, kama kuwa Domain Admin. Dai hili bandia linathibitishwa kimakosa na Domain Controller, kuruhusu ufikiaji usiohalali kwa rasilimali za mtandao katika msitu wa Active Directory.

{% embed url="https://adsecurity.org/?p=541" %}

Exploits nyingine: https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek

Amri za Kiotomatiki za HackTricks

Protocol_Name: Kerberos    #Protocol Abbreviation if there is one.
Port_Number:  88   #Comma separated if there is more than one.
Protocol_Description: AD Domain Authentication         #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for Kerberos
Note: |
Kerberos operates on a principle where it authenticates users without directly managing their access to resources. This is an important distinction because it underlines the protocol's role in security frameworks.
In environments like **Active Directory**, Kerberos is instrumental in establishing the identity of users by validating their secret passwords. This process ensures that each user's identity is confirmed before they interact with network resources. However, Kerberos does not extend its functionality to evaluate or enforce the permissions a user has over specific resources or services. Instead, it provides a secure way of authenticating users, which is a critical first step in the security process.

https://book.hacktricks.xyz/pentesting/pentesting-kerberos-88

Entry_2:
Name: Pre-Creds
Description: Brute Force to get Usernames
Command: nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm="{Domain_Name}",userdb={Big_Userlist} {IP}

Entry_3:
Name: With Usernames
Description: Brute Force with Usernames and Passwords
Note: consider git clonehttps://github.com/ropnop/kerbrute.git ./kerbrute -h

Entry_4:
Name: With Creds
Description: Attempt to get a list of user service principal names
Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs

Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

• Ikiwa unataka kuona kampuni yako ikionekana kwenye HackTricks au kupakua HackTricks kwa muundo wa PDF Angalia MPANGO WA KUJIUNGA!
• Pata swag rasmi ya PEASS & HackTricks
• Gundua The PEASS Family, mkusanyiko wetu wa NFTs ya kipekee
• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @carlospolopm.
• Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye HackTricks na HackTricks Cloud repos za github.