Pass the Ticket (PtT) - Linux
Check If Linux Machine is Domain Joined
realm
david@inlanefreight.htb@linux01:~$ realm list
inlanefreight.htb
type: kerberos
realm-name: INLANEFREIGHT.HTB
domain-name: inlanefreight.htb
configured: kerberos-member
server-software: active-directory
client-software: sssd
required-package: sssd-tools
required-package: sssd
required-package: libnss-sss
required-package: libpam-sss
required-package: adcli
required-package: samba-common-bin
login-formats: %U@inlanefreight.htb
login-policy: allow-permitted-logins
permitted-logins: david@inlanefreight.htb, julio@inlanefreight.htb
permitted-groups: Linux AdminsPS
Finding Kerberos Tickets in Linux
Using Find to Search for Files with Keytab in the Name
To use a keytab file, we must have read and write (rw) privileges on the file.
Identifying Keytab Files in Cronjobs
Finding ccache Files
Reviewing Environment Variables for ccache Files.
Searching for ccache Files in /tmp
Abusing KeyTab Files
Listing keytab File Information
klist Not found: sudo apt-get install krb5-user
Impersonating a User with a keytab
Connecting to SMB Share as another user
Keytab Extract
We were able to impersonate Carlos using the account's tickets to read a shared folder in the domain, but if we want to gain access to his account on the Linux machine, we'll need his password.
We can attempt to crack the account's password by extracting the hashes from the keytab file. Let's use KeyTabExtract, a tool to extract valuable information from 502-type .keytab files, which may be used to authenticate Linux boxes to Kerberos.
1. Extracting Keytab Hashes with KeyTabExtract
With the NTLM hash, we can perform a Pass the Hash (PtH) attack. With the AES256 or AES128 hash, we can forge our tickets using Rubeus or attempt to crack the hashes to obtain the plaintext password.
2. Log in as Carlos
Abusing Keytab ccache
To abuse a ccache file, all we need is read privileges on the file. These files, located in /tmp, can only be read by the user who created them, but if we gain root access, we could use them.
Privilege Escalation to Root
Privilege EscalationLooking for ccache Files
Identifying Group Membership with the id Command
Julio is a member of the Domain Admins group.
Use a ccache file
To use a ccache file, we can copy the ccache file and assign the file path to the KRB5CCNAME variable.
Using Linux Attack Tools with Kerberos
In this scenario, our attack host doesn't have a connection to the KDC/Domain Controller, and we can't use the Domain Controller for name resolution. To use Kerberos, we need to proxy our traffic via MS01 with a tool such as Chisel and Proxychains and edit the /etc/hosts file to hardcode IP addresses of the domain and the machines we want to attack.
Easier with Ligolo-NG
Pivot, Tunneling and Port ForwardingTransfer ccache file
Host File Modified
We need to modify our proxychains configuration file to use socks5 and port 1080.
Proxychains Configuration File
https://github.com/jpillora/chisel
Download Chisel to our Attack Host
Connect to MS01 via RDP and execute chisel (located in C:\Tools).
Connect to MS01 with xfreerdp
Execute chisel from MS01
Finally, we need to transfer Julio's ccache file from LINUX01 and create the environment variable KRB5CCNAME with the value corresponding to the path of the ccache file.
Setting the KRB5CCNAME Environment Variable
Impacket
To use the Kerberos ticket, we need to specify our target machine name (not the IP address) and use the option -k. If we get a prompt for a password, we can also include the option -no-pass.
Using Impacket with proxychains and Kerberos Authentication
Evil-WinRM
Evil-WinRMUsing Evil-WinRM with Kerberos
Miscellaneous
If we want to use a ccache file in Windows or a kirbi file in a Linux machine, we can use impacket-ticketConverter to convert them. To use it, we specify the file we want to convert and the output filename. Let's convert Julio's ccache file to kirbi.
Impacket Ticket Converter
or git clone https://github.com/zer1t0/ticket_converter.git - See Zephyr WU
We can do the reverse operation by first selecting a .kirbi file. Let's use the .kirbi file in Windows.
Importing Converted Ticket into Windows Session with Rubeus
Linikatz
Just like Mimikatz, to take advantage of Linikatz, we need to be root on the machine. This tool will extract all credentials, including Kerberos tickets, from different Kerberos implementations such as FreeIPA, SSSD, Samba, Vintella, etc. Once it extracts the credentials, it places them in a folder whose name starts with linikatz.. Inside this folder, you will find the credentials in the different available formats, including ccache and keytabs.
V2
Last updated