[thread 🧵] Kerberos basics & (ab)use of Certificates within Active Directory (i.e. AD CS and PKINIT)

- Kerberos 101
- Pass-the-Certificate
- UnPAC-the-Hash
- Shadow Credentials
- AD CS escalation (ESC1 to ESC8)

(Links and credits at the end)
[Kerberos 101 ⬇️]

AD-DS offer two main auth protocols: NTLM and Kerberos. Kerberos works with tickets in order to authenticate a user.

A TGT (Ticket Granting Ticket) can be used to obtain a Service Ticket. A Service Ticket can be used to access a service. This is how it works.
1. User requests a TGT (Ticket Granting Ticket)
2. Domain Controller requires pre-authentication
3. User pre-auths and receives a TGT
4. User requests a Service Ticket and gives his TGT
5. DC sends the Service Ticket
6. User can now use the ST and access a service
Let's focus on how pre-auth works.

2. DC requires pre-auth
2.a. Users sends an timestamp, encrypted with on of his Kerberos keys (DES, RC4, AES128 or AES256)
2.a. Alternatively, the user can "use a certificate" (sends a public key, signed by the private key.)
TL;DR: Kerberos pre-authentication can be symmetric (Kerberos key derived from password) or asymmetric (public & private key pair --> x509 certificate).

Kerberos asymmetric pre-auth is called PKINIT
If an attacker knows a user's Kerberos key, he can do some "pass-the-key" to authenticate.

In NTLM, if an attacker knows a user's NT or LM hash, he can do some "pass-the-hash" to authenticate.
Back to Kerberos, if an attacker knows a user's RC4 Kerberos key, which is in fact an NT hash, the attacker will "overpass-the-hash".

If an attacker knows a user's TGT or Service ticket, he will "pass-the-ticket"

[Kerberos 101 ☑️]
[Pass-the-Certificate ⬇️]

If an attacker knows a user's x509 Certificate (or public/private key pair), I dub that "pass-the-certificate".

[Pass-the-Certificate ☑️]
[UnPAC-the-Hash ⬇️]

When using validating Kerberos pre-auth asymmetrically (PKINIT), attackers can recover the user's LM or NT hash. This is UnPAC-the-Hash.

"It's a feature not a vuln" because it indirectly brings support for Certificates with NTLM.

[UnPAC-the-Hash ☑️]
[Shadow Credentials ⬇️]

We now what we can do with certificates, but how can we obtain those.

In short, if an attacker has control over an AD principal able to edit another's msDs-KeyCredentialLink (KCL) attribute, he can gain control over that user or computer principal
1. the attacker creates a public & private key pair and generates a x509 certificate from those
2. the attacker creates a specific binary structure containing the cert's infos and public key.
3. that structure is added to the target's KCL attribute
4. pass-the-certificate
Shadow Credentials is an Access Control (DACLs/ACEs) abuse scenario. It allows for lateral movement and account persistence.

[Shadow Credentials ☑️]
[AD CS escalation ⬇️]

A legitimate way accounts rely on for obtaining certificates is Active Directory Certificate Services (Microsoft's PKI implementation, often enabled and used within orgs IT)

This set of services is dense and extends the attack surface
AD CS is subject to many theft, escalation and persistence vectors. Let's focus on the escalation vectors here. The OG researchers (credits & resources at the end) identified 8 vectors and dubbed them from ESC1 to ESC8.
Escalation vectors identified on:
- misconfigured certificate templates (ESC1 to ESC3)
- dangerous CA configuration (ESC6)
- access control vulnerabilities (ESC4, ESC5, ESC7)
- NTLM relay vulnerability related to the web endpoints of AD CS (ESC8)
Simply put, those escalation vectors mostly allow attackers to obtain a certificate for another account. Attackers can then take control over the other account with Pass-the-Certificate + UnPAC-the-hash
(Attackers can combine Pass-the-Certificate with S4U2Self to gain access to the target account's services (or host).)
AD CS presents an enormous attack surface that tends to be very vulnerable.

[AD CS escalation ☑️]
[The Hacker Recipes 🧑‍🍳]

Want to know more and have practical abuse info?

- Pass-the-Certificate thehacker.recipes/ad/movement/ke…
- UnPAC-the-Hash thehacker.recipes/ad/movement/ke…
- Shadow Credentials thehacker.recipes/ad/movement/ke…
- AD CS escalation thehacker.recipes/ad/movement/ad…
- AD CS escalation
---> ESC1,2,3 - misconfigured certificate templates thehacker.recipes/ad/movement/ad…
---> ESC6 - dangerous CA configuration thehacker.recipes/ad/movement/ad…
---> ESC4,5,6 - access control vulnerabilities thehacker.recipes/ad/movement/ad…
---> ESC8 - web endpoints thehacker.recipes/ad/movement/ad…
[credits ⭐️]
Let's combine crediting and #FF
You all need to follow these MVPs
@harmj0y @tifkin_ @iansus @gentilkiwi @_dirkjan @ExAndroidDev @MGrafnetter @elad_shamir @_wald0 @podalirius_ and many other researchers and contributors that I'm probably forgetting
I hope you like reading this thread.
Something's wrong? Have any question? comments and DMs are welcome :)
Next thread incoming on Kerberos delegation 🐕‍🦺

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Shutdown (Charlie BROMBERG)

Shutdown (Charlie BROMBERG) Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @_nwodtuhs

21 Oct
[thread 🧵] ⚠️ nothing technical here, just sharing about my life

Since 2018, I’ve been creating or contributing to open-source projects, and I was wondering how many hours I spent of my personal time on this.

TL; DR: In 3 years, I squeezed in 1 year of additional free work.
Usually working from 7pm to 9pm almost every day, and from 1pm to 7pm almost every Saturday. This equals to, roughly, 2000+ hours.

I wasn’t very consistent and there were times I was doing 2h/week, some times 20h/week w/o lunch break.
There were also times I switched personal and professional work slots in order to optimise both, but the number of hours is ~ the same

ADHD signals here? Dunno 🤷‍♂️
Read 14 tweets
19 Oct
Shouldn't we all agree that using a certificate to go through a PKINIT Kerberos pre-auth to obtain a TGT should be called Pass-the-Certificate? Or is there a reason we should avoid using that term?
Pass-the-Certificate is useful for the following attacks
- AD CS ESC8 NTLM relay cc/ @harmj0y @tifkin_ @ExAndroidDev
- Shadow Credentials (ACE abuse on accounts' msDs-KeyCredentialLink attribute) cc/ @MGrafnetter @elad_shamir
- UnPAC-the-hash cc/ @_dirkjan @elad_shamir
It can be operated when obtaining a certificate with Rubeus or @_dirkjan's PKINITtools (gettgtpkinit).
Read 4 tweets
22 Jul
[thread] A lot of people since this finding are looking for a bit knowledge around that bug. Below is list of links that will help better understand this (attackers-side)
PetitPotam’s MS-EFSR abuse is the equivalent (even better) of the PrinterBug’s MS-RPRN abuse that’s been here for a while now

1️⃣ PrinterBug: thehacker.recipes/active-directo…
2️⃣ PetitPotam: thehacker.recipes/active-directo…
Coercing a machine’s authentication is a technique allows for the capture or relay of that auth.

1️⃣ capture: thehacker.recipes/active-directo…
2️⃣ relay: thehacker.recipes/active-directo…
Read 12 tweets
20 Jul
[thread] Hi hackers! @podalirius_ and I present to you this new tool 🌟🎀 𝖘𝖒𝖆𝖗𝖙𝖇𝖗𝖚𝖙𝖊 🎀🌟

This tool allows for bruteforcing NTLM and Kerberos in Active Directory domains (there are A LOT of features, detailed in the thread below).

➡️ github.com/ShutdownRepo/s…
This tool offers two modes: smart and brute.

1⃣ Brute mode: can be used with a user and password/hash to test (or list of those).

2⃣ Smart mode: given a valid AD account credentials, it fetches the users list and lockout policies to bruteforce wihtout locking accounts.
Authentication attempts can be operated over NTLM (over SMB or LDAP) or Kerberos 🐶 (pre-authentication attacks).

Kerberos pre-authentication attempts can be operated through UDP (faster 🚅) or TCP.
Read 17 tweets
22 Apr
(infosec thread) one of my latest tweets was followed by some questions in my DMs. So let's answer those here and remind some concepts😈

I'll talk about pass-the-hash, pass-the-ticket, pass-the-key, overpass-the-hash, pass-the-cache, silver and golden tickets 👇
Pass-the-Hash (1/4) : NTLM (LM, LMv2, NTLM or NTLMv2 depending on the version) is an authentication protocol used by Windows and AD-DS. Users have passwords, which are stored in a hashed format (LM or NT hash depending on the security settings and version).
Pass-the-Hash (2/4) : when authenticating to a remote service, the password hash is used to compute a ChallengeResponse. The LM hash is used for the LM version of the protocol while the NT hash is used for LMv2, NTLM and NTLMv2.
Read 25 tweets
21 Apr
@podalirius_ and I made GPP Passwords great again. We wrote a Python script, using Impacket, to find and decrypt passwords in Group Policy Preferences, without having to mount the remote share 👇[a thread]

➡️ github.com/SecureAuthCorp…
The script can be directly added to Impacket's examples (like in the PR above) but it can also be run as a standalone tool (clone the repo below)

github.com/ShutdownRepo/G…
Just like all other Impacket examples, the logging is color-less and it can be quite a mess (with the -debug option)

However, grc (github.com/garabik/grc) can bring colors to the output
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

:(