Kerberos Overview

Previous articles demonstrated how to compromise Windows, establishing an initial foothold in the environment. It's time to step it up a gear and hack Active Directory's preferred authentication protocol, Kerberos. Before compromising Active Directory, we need to understand how Kerberos works.

Overview

In simple terms, Kerberos is an authentication protocol allowing you, as the user to mutually authenticate and consume resources on the Windows Active Directory Domain. Kerberos is the preferred authentication mechanism, Kerberos will fall back to NTLM, which is less secure, when it's not possible to establish Kerberos, for example connecting to a resource via IP.

Kerberos communicates over UDP and TCP port 88.

At no point is a password passed or travels over the network, instead symmetric encryption based on a shared secret is used. The user's password or NTLM hash is the users 'Secret Key', the Domain Controller can derive the user's secret key as it has access to the user's NTLM hash, this is the shared secret.

The KDC (Key Distribution Center) is an integral part of all Windows Domain Controllers. The KDC provides 2 functions with the Authentications Service (AS) and the Ticket Granting Service (TGS). The KDC runs under the identity of the KRBTGT service account and is responsible for handling all signing and encryption of all Kerberos tickets.

The AS is responsible for the initial authentication and distributing of the Ticket Granting Ticket (TGT).

The TGS provides the authentication service for validating the TGT and subsequently distributing Service Tickets.

Simplified Kerberos Ticket Exchange

0. CREDS

User enters credentials on a client

1. AS_REQ

Client send pre-authentication to the KDC

2.AS_REP

KDC validates user and sends back TGT and Logon Session Key encrypted with the users secret key

The Client decrypts the Logon Session Key and then extracts the TGT

3. TGS_REQ

Client send the KDC a request to access a service.

4.TGS_REP

KDC replies with a new Service Ticket and new Service Session Key

The Client decrypts the Service Session Key with the Logon Session Key

5. AP_REQ

The Client sends the Service Ticket to the Server and is decrypted with the Service's secret key

6. AP_REP

The Server responds granting access to the user.

Simply Kerberos Ticket Exchange (Graphical)

Detailed Kerberos Ticket Exchange

0. User logs on with Username and Password

Creds > Winlogon.exe > Secur32.dll > Local Security Authority (Lsasrv.dll > Spnego.dll > Kerberos.dll) >>>> LSA of the DC > KDC AS

When a user enters their credentials, the credentials are passed to the Client for processing and it's in fact the Client making the initial and subsequent requests to the KDC. It's the client that has the secure channel and not the user.

1. Kerberos authentication service request (KRB_AS_REQ)
Client requests a ticket from the KDC (AS) by sending the following info:

Users Authentication (Pre-Authentication) request

Timestamp (encrypted with user's NTLM password hash and converted to a symmetric Users Secret Key)

TGT Service Request (clear text)

Client IP
Client Principal name

Nonce (Number Once, a unique number to prevent relay attacks)

2. Kerberos authentication service response (KRB_AS_REP)

KDC (AS) decrypts the timestamp with the Users Secret Key, as this is also known to the KDC

KDC (AS) validates the user request and replies with the TGT and Logon Session Key

Logon Session Key (encrypted with the Users Secret Key)

Timestamp
Lifetime
TGT

Nonce (Users nonce to prevent relay attacks)

Ticket Granting Ticket (TGT) (encrypted with the KRBTGT Secret Key)

Logon Session Key

Time Stamp

Users Authentication

Username

Group Membership

Client IP
Expiry date and time = 10 hours
PAC File (Privilege Attribute Certificate) Data Structure contains authorization data controlling access to resources. For an interactive logon the following fields are required:

LogonTime

LogoffTime

KickOffTime

PasswordLastSet

PasswordCanChange

EffectiveName

FullName

LogonScript

ProfilePath

HomeDirectory

HomeDirectoryDrive

LogonCount

BadPasswordCount

LogonServer

LogonDomainName

UserAccountControl

The client decrypts the Logon Session Key with the Users Secret Key

The client extracts the TGT from the decrypted Logon Session Key

3. Kerberos ticket-granting service (TGS) request (KRB_TGS_REQ)
When a user requires access to an SMB Share, Exchange, SQL Server etc, a request to the KDC (TGS) for a separate Service Ticket and Session Key is made, based on the Service Principal Name.

Service Name of SQL Server (SPN)

TGT (encrypted with the KRBTGT Secret Key)

Authenticator data (username and timestamp) (encrypted with the Logon Session Key)

Nonce (Users nonce to prevent relay attacks)

The KDC (TGS) decrypts TGT with its Secret Key and extracts the user's Logon Session Key

The KDC (TGS) decrypts the Authenticator Data with the Logon Session Key.

4. Kerberos ticket-granting service (TGS) response (KRB_TGS_REP)
KDC (TGS) replies with the Ticket Granting Service ticket and a new Service Session Key for accessing the SQL Server

The Service Principal Name (SPN) (encrypted with Logon Session Key)

TGS ticket (encrypted with the Service Accounts Secret Key)

Service Session Key

Users Authenticator data

Expiry date and time = 10 hours
PAC
Username

Client IP

Service Session Key (encrypted with Logon Session Key)

Expiry date and time = 10 hours

Nonce (Users nonce to prevent relay attacks)

The client decrypts the Service Session Key with the Logon Session Key

5. Kerberos application server request (KRB_AP_REQ)
The client sends Authenticator Data and TGS ticket to the SQL Server

Authenticator data (username and timestamp) (encrypted with the Service Session Key)

TGS Ticket (encrypted with the Service Accounts Secret Key)

Service Session Key

Users Authenticator Data
Service Account Password

PAC
User Name
Users SID
Users Group membership

The SQL Server Service decrypts the TGS Ticket with its secret key and extracts the Users Authenticator Data

The SQL Server validates Group Membership and assigns the appropriate permissions.

6. Kerberos application server response (KRB_AP_REP)

The SQL Server Service responds by encrypting the Time from Users Authenticator Data with the Service Session Key

Time Stamp (Encrypted with the Service Session Key)

The client decrypts the Time Stamp with the Service Session Key and access's the SQL Server

The client then uses the Service Session Key to perform all further communication until the session key expires.

In most cases the Server Service will accept the TGS Ticket without any further validation with the Domain Controller.

Detailed Kerberos Ticket Exchange (Graphical)

Bedtime Reading

Here's some bedtime reading regarding Kerberos, Authentication and the PAC file