Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SEC560 enterprise penetration testing > SEC560.5 domain domination and Azure annihilation > Flashcards

SEC560.5 domain domination and Azure annihilation Flashcards

1
Q

Three components of Kerberos

A
  1. KDC (key distribution center)
  2. Client (requesting services)
  3. Service (Service Principal Name)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

SPN

A

Service Principal Name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Each party in a Kerberos environment _______ to the Kerberos server and receives a __________

A
  1. Authenticates
  2. TGT (ticket granting ticket)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

If Kerberos can’t be used, Windows will fall back to _____

A

NTLM v1/v2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Primary authentication mechanism in the Microsoft Active Directory domain

A

Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Kerberos allows a _________ and _________ to authenticate over an _________ _________ channel

A

Client
Server
Insecure
Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

KDC

A

Key distribution center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

SPN is an exclusive term to _________

A

Kerberos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The AS (_________ _________) is a logical role on the _________ _________

A

Authentication server
Domain controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

TGS

A

Ticket granting service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Another logical role of the KDC/DC:

A

TGS (ticket granting service)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is sent by the client in the (first) pre-authentication step for Kerberos authN?

A

User’s workstation sends AS-REQ to the AS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the AS-REQ include?

A

Timestamp encrypted with user’s NT hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does KDC verify AS-REQ?

A

Has user’s password hash in db and will attempt to decrypt the message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What happens if KDC can verify AS-REQ?

A

If timestamp still valid, client is given TGT by the TGS (AS-REP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The client first receives a TGT for the _______ service and can be used to ________________________

A

krbtgt

Request other tickets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

PAC

A

Privileged attribute certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

KDC long-term secret key usage (1)

A

Encrypt TGT (AS-REP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

KDC long-term secret key usage (2)

A

Sign PAC

(AS-REP and TGS-REP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Client long-term secret key usage (1)

A

Check encrypted timestamp (AS-REQ)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Client long-term secret key usage (2)

A

Encrypt session key (AS-REP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Target (SPN) long-term secret key usage (1)

A

Encrypt service portion of the ST (TGS-REP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Target (SPN) long-term secret key usage (2)

A

Sign PAC (TGS-REP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

KDC long-term secret key is the password hash of the ________ service account

A

krbtgt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Client long-term secret key is the _______ _________ of the ________ acct

A

password hash

Client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Most risky Kerberos long term secret key to compromise

A

KDC long-term secret key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Advantage of compromising KDC long-term secret key

A

Can recreate TGTs and sign PACs, allowing us to obtain all privileges within the domain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

PAC contains

A

user’s authorization and privileges

e.g., group memberships

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

With ______ hash, it’s possible to forge _____ to contain any desired privilege in the domain

A

krbtgt

PAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Kerberos 3 long-term keys

A

KDC (domain controller)

Client

Target (SPN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Kerberos is stateful or stateless?

A

Stateless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

In Kerberos, state is stored in ______

A

Tickets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

PAC is contained within the ____

A

TGT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

PAC is signed with what 2 keys

A

Target LT key

KDC LT key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

The _____ is the first ticket received by the client

A

TGT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

For TGT, the target is the _____ account

A

krbtgt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

To prevent entire TGT from being tampered with

A

It is encrypted with KDC long-term key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

In the TGS-REQ, the user wants to

A

Authenticate to a certain service

39
Q

In the TGS-REQ, the user sends the following to the KDC

A

An authenticator message (encrypted with the Client/TGS session key)

Encrypted TGT and a ticket request (referencing a certain SPN)

40
Q

The TGT contains a Client/TGS _____ ______ is used for __________________

A

session key

future communications between the client and the TGS

41
Q

TGT contains what data related to time

A

start time

End time

MaxRenew

42
Q

In Kerberos flow, authorization is the responsibility of the KDC or the target service?

A

Target service (SPN)

43
Q

ST

A

Service ticket

44
Q

ST has 2 parts:

A

Client portion

Server portion

45
Q

ST client portion:

A

Encrypted using Client/TGS session key (so it can be decrypted by the client)

46
Q

ST server portion

A

Encrypted using target LT key (password hash of target service)

Also includes PAC

47
Q

SPN is formatted as

A

serviceclass/host:port

48
Q

When is the port included in the SPN?

A

If the service runs on a nonstandard port

49
Q

Examples of service class in an SPN

A

HTTP, HOST, TERMSVR, MSSQLSvc

50
Q

The host in the SPN is typically the

A

FQDN

51
Q

Since the Service Ticket is encrypted, using the password hash of the target service, KDC needs to store a mapping of….

A

… the SPN to the underlying account so it can select the correct hash to use the encryption key

52
Q

What does this tool do?

setspn.exe

A

Create mappings of SPNs to underlying accounts

Get a list of SPNs

53
Q

SMTP/cliff.sec560.local > mailsvc

This is an example of:

A

KDC mapping of SPN to underlying account

54
Q

In Kerberos, to access a service, the user presents the ________ _________ to the target server

A

Service ticket

55
Q

The service ticket is encrypted using the ___________ _________ of the target service account

A

Password hash

56
Q

A client can request a ticket for a service, even if

A
  • client would not have permissions to access the service
  • the service is not accessible to the client due to fire wall rules, etc.
  • the server could be off-line
  • The server could be removed from the environment, as long as the SPN still exists
57
Q

Kerberoast attack

A

Request USER account tickets then crack them

(depends on a crackable password set by a user or admin)

58
Q

setspn -T * -Q /

A

Query SPNs command

59
Q

Multiple tools available to obtain tickets (Kerberoasting)

A

Impacket GetUserSPNs.py

Invoke-Kerberoast (PowerShell and Empire)

PowerShell (manual) plus mimikatz to extract from RAM

60
Q

Kerberoast attack steps (4)

A
  1. Query AD for USER accounts with SPNs
  2. Request RC4 (or AES) Service Tickets from the Domain Controller using these SPN values
  3. Extract received Service Tickets and dump to file
  4. Brute force offline to recover the credential (NT hash/password) that was used to encrypt the Service Ticket
61
Q

Most common KDC “etypes” (encryption types):

A

23 — RC4
17 — AES128
19 — AES256

62
Q

In Kerberoasting, focus on accounts that have:

A

Elevated domain privileges

Access to sensitive data

63
Q

Pass-the-Ticket

A

A stolen Kerberos ticket allows access as user on another system

64
Q

What is required for Pass-the-Ticket to be exploited?

A

Local admin access to a machine where victim user is logged in

65
Q

What is required for Pass-the-Ticket to be exploited?

A

Local admin access to a machine where victim user is logged in

66
Q

Tools for Pass-the-Ticket

A

Mimikatz can export all tickets to a file:
kerberos::list /export

Rubeus has similar functionality

67
Q

Pass the ticket attacks could involve both ____ and/or ______ ticket types

A

ST

TGT

68
Q

Overpass-the-Hash

A

Variant of Pass-the-Hash when NTLM is disabled

Uses stolen password hash to perform pre-authentication and get valid TGT for the user

69
Q

Golden Ticket

A

Use password hash of krbtgt account to forge TGT

(e.g., make ourselves domain admin with forged PAC and more permissions)

70
Q

5 ways to persist admin access to the AD:

A

Dump NTDS.dit (all creds)

Create domain admin account (w strong creds)

Create Kerberos golden ticket allowing long-term access

Create Skeleton Key, allows authN as any user in environment

DCSync attack

71
Q

Domain password hashes are in the __________ file

A

ntds.dit

72
Q

System key (used to encrypt ntds.dit) is stored in

A

HKLM\System

Registry hive

73
Q

How to access ntds.dit file (3 ways):

A

Use the Volume Shadow Copy service to create a read only copy and download the file

Use ntdsutil.exe and the “install for media” (IFM) capability

Poorly secured backups of the domain controller drives (e.g., open network shares)

74
Q

Commonly used tool to decrypt and extract hashes from NTDS.DIT

A

Impacket secretsdump.py

75
Q

A simple attack to achieve persistence in Active Directory

A

create a new domain admin user with a password that never expires

76
Q

2 attacks to never perform in production

A

Skeleton key

DC shadow

77
Q

Skeleton key only works for

A

Kerberos RC4 encryption

78
Q

Skeleton key attack runs in memory so is therefore not _________

A

Persistent

79
Q

Skeleton key runs on the _____ _________ in memory

A

domain controller

80
Q

Skeleton key attack allows anyone to authenticate as any user with password of

A

mimikatz

(default)

81
Q

DCSync attack uses _____ _______ protocol to mimic DC

A

Domain replication

82
Q

DCSync attack will ________ a DC and request ________ from a target DC

A

Impersonate

Replication

83
Q

DCSync requires

A

Domain admin

Replication privileges

84
Q

Example prerequisite attack for
DCSync attack

A

Golden Ticket to obtain domain admin

85
Q

dCShadow attack

A

Pushes updates to legitimate DC

86
Q

Prerequisite to DCShadow attack

A

Obtain Domain Admin rights

87
Q

A Golden Ticket is a forged _____ and is signed with _______ hash

A

TGT

krbtgt

88
Q

Golden Ticket is used for

A

Persistence

89
Q

Golden Ticket requires the

A

NT hash of the krbtgt account

Or the AES key of the krbtgt account

90
Q

Kerberos flow with Golden Ticket SKIPS …..

A

Logging on (AS-REQ / AS-REP)

91
Q

Golden Ticket forgery is possible once attacker has the _____ ______

A

krbtgt hash

92
Q

Golden Ticket is typically a TGT for

A

Admin account (RID 500 in the domain)

Domain Admin

Member of Domain Admins or other powerful group

93
Q

Golden Ticket tools

A

Impacket ticketer.py

Mimikatz - original tool for ticket creation

Rubeus

94
Q

To generate Golden Ticket you need 3 pieces of data:

A

krbtgt hash

Domain SID (S-1-5-21-xxx-yyy-zzz)

Full domain name

SEC560 enterprise penetration testing (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions