Pass the Ticket (PtT) from Linux
A Linux computer connected to Active Directory commonly uses Kerberos as authentication. Suppose this is the case, and we manage to compromise a Linux machine connected to Active Directory. In that case, we could try to find Kerberos tickets to impersonate other users and gain more access to the network.
A Linux system can be configured in various ways to store Kerberos tickets. We'll discuss a few different storage options in this section.
Note: A Linux machine not connected to Active Directory could use Kerberos tickets in scripts or to authenticate to the network. It is not a requirement to be joined to the domain to use Kerberos tickets from a Linux machine.
Kerberos on Linux
In most cases, Linux machines store Kerberos tickets as ccache files in the /tmp directory. By default, the location of the Kerberos ticket is stored in the environment variable KRB5CCNAME
Another everyday use of Kerberos in Linux is with keytab files. A keytab is a file containing pairs of Kerberos principals and encrypted keys (which are derived from the Kerberos password).
Linux auth from MS01
To practice and understand how we can abuse Kerberos from a Linux system, we have a computer (
LINUX01) connected to the Domain Controller. This machine is only reachable throughMS01. To access this machine over SSH, we can connect toMS01via RDP and, from there, connect to the Linux machine using SSH from the Windows command line. Another option is to use a port forward. If you don't know how to do it, you can read the module Pivoting, Tunneling, and Port Forwarding.
As an alternative, we created a port forward to simplify the interaction with LINUX01. By connecting to port TCP/2222 on MS01, we will gain access to port TCP/22 on LINUX01.
Let's assume we are in a new assessment, and the company gives us access to LINUX01 and the user david@inlanefreight.htb and password Password2.
Linux auth via port forward
Identifying Linux and Active Directory integration
We can identify if the Linux machine is domain-joined using realm, a tool used to manage system enrollment in a domain and set which domain users or groups are allowed to access the local system resources.
realm - Check if Linux machine is domain-joined
PS - Check if Linux machine is domain-joined
Finding KeyTab files
A straightforward approach is to use find to search for files whose name contains the word keytab. When an administrator commonly creates a Kerberos ticket to be used with a script, it sets the extension to .keytab. Although not mandatory, it is a way in which administrators commonly refer to a keytab file.
Using Find to search for files with keytab in the name
Note: To use a keytab file, we must have read and write (rw) privileges on the file.
Another way to find KeyTab files is in automated scripts configured using a cronjob or any other Linux service. If an administrator needs to run a script to interact with a Windows service that uses Kerberos, and if the keytab file does not have the .keytab extension, we may find the appropriate filename within the script. Let's see this example:
Identifying KeyTab files in Cronjobs
In the above script, we notice the use of kinit, which means that Kerberos is in use. kinit allows interaction with Kerberos, and its function is to request the user's TGT and store this ticket in the cache (ccache file). We can use kinit to import a keytab into our session and act as the user.
In this example, we found a script importing a Kerberos ticket (svc_workstations.kt) for the user svc_workstations@INLANEFREIGHT.HTB before trying to connect to a shared folder. We'll later discuss how to use those tickets and impersonate users.
Note: As we discussed in the Pass the Ticket from Windows section, a computer account needs a ticket to interact with the Active Directory environment. Similarly, a Linux domain-joined machine needs a ticket. The ticket is represented as a keytab file located by default at
/etc/krb5.keytaband can only be read by the root user. If we gain access to this ticket, we can impersonate the computer account LINUX01$.INLANEFREIGHT.HTB
Finding ccache files
A credential cache or ccache file holds Kerberos credentials while they remain valid and, generally, while the user's session lasts. Once a user authenticates to the domain, a ccache file is created that stores the ticket information. The path to this file is placed in the KRB5CCNAME environment variable
Reviewing environment variables for ccache files
As mentioned previously, ccache files are located, by default, at /tmp. We can search for users who are logged on to the computer, and if we gain access as root or a privileged user, we would be able to impersonate a user using their ccache file while it is still valid.
Searching for ccache files in /tmp
Abusing KeyTab files
As attackers, we may have several uses for a keytab file. The first thing we can do is impersonate a user using kinit. To use a keytab file, we need to know which user it was created for. klist is another application used to interact with Kerberos on Linux. This application reads information from a keytab file. Let's see that with the following command:
Listing KeyTab file information
The ticket corresponds to the user Carlos. We can now impersonate the user with kinit. Let's confirm which ticket we are using with klist and then import Carlos's ticket into our session with kinit.
Note: kinit is case-sensitive, so be sure to use the name of the principal as shown in klist. In this case, the username is lowercase, and the domain name is uppercase.
Impersonating a user with a KeyTab
We can attempt to access the shared folder \\dc01\carlos to confirm our access.
Connecting to SMB Share as Carlos
Note: To keep the ticket from the current session, before importing the keytab, save a copy of the ccache file present in the environment variable
KRB5CCNAME.
KeyTab Extract
The second method we will use to abuse Kerberos on Linux is extracting the secrets from a keytab file. We were able to impersonate Carlos using the account's tickets to read a shared folder in the domain, but if we want to gain access to his account on the Linux machine, we'll need his password.
We can attempt to crack the account's password by extracting the hashes from the keytab file. Let's use KeyTabExtract, a tool to extract valuable information from 502-type .keytab files, which may be used to authenticate Linux boxes to Kerberos. The script will extract information such as the realm, Service Principal, Encryption Type, and Hashes.
Extracting KeyTab hashes with KeyTabExtract
With the NTLM hash, we can perform a Pass the Hash attack. With the AES256 or AES128 hash, we can forge our tickets using Rubeus or attempt to crack the hashes to obtain the plaintext password.
Note: A KeyTab file can contain different types of hashes and can be merged to contain multiple credentials even from different users.
The most straightforward hash to crack is the NTLM hash. We can use tools like Hashcat or John the Ripper to crack it. However, a quick way to decrypt passwords is with online repositories such as https://crackstation.net/, which contains billions of passwords.
As we can see in the image, the password for the user Carlos is Password5. We can now log in as Carlos.
Log in as Carlos
Obtaining more hashes
Carlos has a cronjob that uses a KeyTab file named svc_workstations.kt. We can repeat the process, crack the password, and log in as svc_workstations.
Abusing KeyTab ccache
To abuse a ccache file, all we need is read privileges on the file. These files, located in /tmp, can only be read by the user who created them, but if we gain root access, we could use them.
Once we log in with the credentials for the user svc_workstations, we can use sudo -l and confirm that the user can execute any command as root. We can use the sudo su command to change the user to root.
Privilege escalation to root
As root, we need to identify which tickets are present on the machine, to whom they belong, and their expiration time.
Looking for ccache files
There is one user (julio@inlanefreight.htb) to whom we have not yet gained access. We can confirm the groups to which he belongs using id.
Identifying group membership with the id command
Julio is a member of the Domain Admins group. We can attempt to impersonate the user and gain access to the DC01 Domain Controller host.
To use a ccache file, we can copy the ccache file and assign the file path to the KRB5CCNAME variable.
Importing the ccache file into our current session
Note: klist displays the ticket information. We must consider the values "valid starting" and "expires." If the expiration date has passed, the ticket will not work.
ccache filesare temporary. They may change or expire if the user no longer uses them or during login and logout operations.
Using Linux attack tools with Kerberos
Many Linux attack tools that interact with Windows and Active Directory support Kerberos authentication. If we use them from a domain-joined machine, we need to ensure our KRB5CCNAME environment variable is set to the ccache file we want to use. In case we are attacking from a machine that is not a member of the domain, for example, our attack host, we need to make sure our machine can contact the KDC or Domain Controller, and that domain name resolution is working.
In this scenario, our attack host doesn't have a connection to the KDC/Domain Controller, and we can't use the Domain Controller for name resolution. To use Kerberos, we need to proxy our traffic via MS01 with a tool such as Chisel and Proxychains and edit the /etc/hosts file to hardcode IP addresses of the domain and the machines we want to attack.
Host file modified
We need to modify our proxychains configuration file to use socks5 and port 1080.
Proxychains configuration file
We must download and execute chisel on our attack host.
Download Chisel to our attack host
Connect to MS01 via RDP and execute chisel (located in C:\Tools).
Connect to MS01 with xfreerdp
Execute chisel from MS01
Note: The client IP is your attack host IP.
Finally, we need to transfer Julio's ccache file from LINUX01 and create the environment variable KRB5CCNAME with the value corresponding to the path of the ccache file.
Setting the KRB5CCNAME environment variable
Impacket
To use the Kerberos ticket, we need to specify our target machine name (not the IP address) and use the option -k. If we get a prompt for a password, we can also include the option -no-pass.
Using Impacket with proxychains and Kerberos authentication
Note: If you are using Impacket tools from a Linux machine connected to the domain, note that some Linux Active Directory implementations use the FILE: prefix in the KRB5CCNAME variable. If this is the case, we need to modify the variable only to include the path to the ccache file.
Evil-WinRM
To use evil-winrm with Kerberos, we need to install the Kerberos package used for network authentication. For some Linux like Debian-based (Parrot, Kali, etc.), it is called krb5-user. While installing, we'll get a prompt for the Kerberos realm. Use the domain name: INLANEFREIGHT.HTB, and the KDC is the DC01.
Installing Kerberos authentication package
Default Kerberos v5 realm
The Kerberos servers can be empty.
Administrative server for your Kerberos realm
In case the package krb5-user is already installed, we need to change the configuration file /etc/krb5.conf to include the following values:
Kerberos configuration file for INLANEFREIGHT.HTB
Now we can use evil-winrm.
Using Evil-WinRM with Kerberos
Miscellaneous
If we want to use a ccache file in Windows or a kirbi file in a Linux machine, we can use impacket-ticketConverter to convert them. To use it, we specify the file we want to convert and the output filename. Let's convert Julio's ccache file to kirbi.
Impacket Ticket converter
We can do the reverse operation by first selecting a .kirbi file. Let's use the .kirbi file in Windows.
Importing converted ticket into Windows session with Rubeus
Linikatz
Linikatz is a tool created by Cisco's security team for exploiting credentials on Linux machines when there is an integration with Active Directory. In other words, Linikatz brings a similar principle to Mimikatz to UNIX environments.
Just like Mimikatz, to take advantage of Linikatz, we need to be root on the machine. This tool will extract all credentials, including Kerberos tickets, from different Kerberos implementations such as FreeIPA, SSSD, Samba, Vintella, etc. Once it extracts the credentials, it places them in a folder whose name starts with linikatz.. Inside this folder, you will find the credentials in the different available formats, including ccache and keytabs. These can be used, as appropriate, as explained above.
Linikatz download and execution
Lab - Questions
SSH to 10.129.204.23 (ACADEMY-PWATTACKS-LM-MS01) with user "david@inlanefreight.htb" and password "Password2"
Connect to the target machine using SSH to the port TCP/2222 and the provided credentials. Read the flag in David's home directory.
Which group can connect to LINUX01?
Look for a keytab file that you have read and write access. Submit the file name as a response.
We can see two files with differents permissions
Extract the hashes from the keytab file you found, crack the password, log in as the user and submit the flag in the user's home directory.
With the carlos.heytab can keytabextracto to get the NTLM hash -->
Once we have it, pass this hash for crackstation to obtain the clear password and do su-->
Check Carlos' crontab, and look for keytabs to which Carlos has access. Try to get the credentials of the user svc_workstations and use them to authenticate via SSH. Submit the flag.txt in svc_workstations' home directory.
We can observe this until line how obtain a directorie abou t .sh of kerberos script, read it
Also, we can see the .kt of svc user, so... now, we need extrat the NTML again -->
But... it isnt he NTML hash... so, read al directorio of scripts -->
We can see the john.keytab, so... do the keytab extract -->
Pass it to crackstation and obtain the clear password and make a escalation -->
john : Password3
And exist anothers file that we can make the keytab extaction -->
svc_workstations : Password4
Check the sudo privileges of the svc_workstations user and get access as root. Submit the flag in /root/flag.txt directory as the response.
Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio.
Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_).
I will use the linikatz.sh -->
We can observe a file that there is linux01 -->
Now use it -->
Last updated