Controlling and monitoring Access

Question 1

Kerberos Definition

Answer 1

Authentication system that uses ticketing.

Uses symmetric key encryption for confidentiality and integrity of communications.

Question 2

Kerberos System Components

Answer 2

Key distribution center (KDC): Trusted third party that provide authentication services. All clients and servers are registered with the KDC

Kerberos Authentication Server: Hosts the KDC services: Ticket Granting Service (TGS) and Authentication Service (AS).

Ticket: Encrypted message that provides proof a subject is authorized to access an object. (AKA Service Ticket)

Ticket Granting Ticket (TGT): Encrypted message providing proof subject has authenticated through the KDC and is authorized to request tickets to access objects. Contains symmetric key, IP address and expiration date.

Kerberos Principle: An entity (typically a user) that can be granted it ticket

Kerberos Realm: A logical area such as domain that is controlled by Kerberos.

Question 3

Kerberos Login Process (6 steps)

Answer 3

1. Enter credentials
2. Client sends encrypted credentials to KDC
3. KDC verified credentials
4. KDC creates symmetric key hashed with user’s password. It also creates timestamped encrypted TGT.
5. KDC sends symmetric key and TGT to client
6. Client installs TGT until it expires and decrypts using hash of user password.

Question 4

Kerberos Object Access Process

Answer 4

1. Client sends TGT to KDC with request to access a resource
2. KDC verifies TGT and checks access list to see if subject is authorized to access object
3. KDC generates service ticket and sends to client
4. Client sends service ticket to server/service hosting object for access
5. Server/service verified validity of service ticket with KDC
6. Once identity and authorization is verified by KDC and service, access is granted to subject.

Question 5

Pass the Hash

Answer 5

?

Question 6

Overpass the Hash

Answer 6

Attacker requests a TGT with the user’s hash and use this to access network resources. Used when NTLM is disabled on network and Pass the Hash is not available. also called pass the key

Question 7

Pass the Ticket

Answer 7

Try to harvest tickets from lsass.exe and then inject them into a user to attempt impersonation.

Question 8

Silver Ticket

Answer 8

Captures NTLM hash from a service account to create a ticket granting service ticket. Gives hacker same access as service account.

Question 9

Golden Ticket

Answer 9

Steals hash of the KRBTGT kerberos service account. Can create tickets at will.

Question 10

Kerberos Brute-force

Answer 10

used to guess usernames and passwords. kerberos reports if they are valid.

Question 11

ASREPRoast

Answer 11

Identifies users that don’t have kerberos pre-authentication enabled. C

Question 12

ASREPRoast

Answer 12

Identifies users that don’t have kerberos pre-authentication enabled.

Question 13

Kerberoasating

Answer 13

Collects TGTs or TGSs and tries to decrypt them offline.