search

Linux PtT

hashtag
Kerberos and Linux

Even if it's less common, Linux machines can also connect to Active Directory, but here's the take: it is not mandatory for a Linux machine to ==join== the domain in order to use Kerberos, as they can use Kerberos Tickets in scripts or to authenticate to the network.

Windows and Linux machines both request TGTs and TGSs in the same manner, but the difference is in ==storing these tickets==. On Linux, it highly depends on the distribution in use but in general, they are stored in two file types:

  1. ccache files: files residing in /tmp directory with read and write protections. The environment variable KRB5CCNAME identifies if the tickets are in-use or the default location is changed. ==A user with elevated privileges has access to these tickets.==

  2. keytab files: These files, used to authenticate the user to various services in the current session without a password, contain pairs of Kerberos principles and encrypted keys which are related with the Kerberos password. It is important to note that the keytab files need to be changed after each password change. These files are commonly used in scripts to access files stored in the Windows share folder without human interaction. They do not depend on the system in which they were created on, so they're portable to use in other computers.

hashtag
Identifying AD within Linux

hashtag
1- realme Tool

$realm list

inlanefreight.htb
  type: kerberos
  realm-name: INLANEFREIGHT.HTB
  domain-name: inlanefreight.htb
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %U@inlanefreight.htb
  login-policy: allow-permitted-logins
  permitted-logins: david@inlanefreight.htb, julio@inlanefreight.htb
  permitted-groups: Linux Admins

hashtag
2- Look for sssd and winbind processes

sssd and winbind are tools used for integrating AD within Linux.

hashtag
Finding Kerberos Tickets

hashtag
Hunting for Keytab Files

Remember that to use keytab files you need read and write permissions.

File extension lookup

Cronjobs

kinit allows interaction with Kerberos and works on requesting the user's TGT and store it in ccache file. This is a ==target==.

Since the tickets are represented as keytab files in the Linux environment, we will try to gain access to these files found by default on /etc/krb5.keytab.

We will use kinit to import a keytab into our session and act as the user. In the case above, the script is importing svc_workstation.kt which belongs to svc_workstation@INLANEFREIGHT.HTB.

hashtag
Hunting for ccache files

While theyre still valid, of course, we can abuse these ccache files to impersonate a user. But first let's find them:

hashtag
Abusing keytab files

We will use two methods.

  • The first one will give us access to specific shared folders in the context of the victim.

  • The second one will give us access to his entire account if we can perform a PtH with an NTLM hash, forge our own tickets with Rubeus using his AES Hash or cracking them :3 .

hashtag
Method 1: Importing Tickets

We need to know to which user this KeyTab file belongs to and then abuse it.

hashtag
Extract valuable information from KeyTab files

hashtag
Impersonating a user with KeyTab

This confirms that we're using David's ticket.

IMPORTANT: Before importing another user's ticket we should make a copy of the current session's ticket and not lose it later. The ticket resides by default in the KRB5CCNAME environment variable

Now let's import carlos' ticket:

By now, we can now act as carlos and access whatever shares intended for him.

hashtag
Method 2: KeyTabExtract tool

It is important to note that a single keytab file can contain various information about several and different users. All in one file. Good for us. If we successfully crack the password, we can login as the victim, and obtain even more hashes through other keytab files that are being used by scripts or cronjobs. As an example:

Carlos has a cronjob that uses a keytab file named svc_workstations.kt. We can repeat the process, crack the password, and log in as svc_workstations.

hashtag
Abusing ccache files

These files are located in /tmp and needs read+write permissions to abuse them. So we need to escalate to root in order to get whatever we need about the ccache file's owner.

To gain valuable intel on the victim, we can look at the groups that our target belongs to and maybe aim for the ones administrative rights of course. If one belongs to the local admins group, we will indeed get access to the DC host. Juicy enough!

hashtag
Importing the ccache File to the Current Session

Checking what ccache files are loaded:

Note: klist displays the ticket information. We must consider the values "valid starting" and "expires." If the expiration date has passed, the ticket will not work. ccache files are temporary. They may change or expire if the user no longer uses them or during login and logout operations.

Making a copy of the ccache file to use and importing it:

Checking the importation:

We successfully imported to ccache file to the current session, now we can access to the victim's (Julio in the example above.) Now we can access the victim's shares:

PreviousLocal Windows Password AttacksNextWindows PtT