Collaborate Disseminate
In the Windows ktpass command, the –ptype option can be used to specify a principal type. Is there a similar option in ktutil, kinit or any of the Linux Kerberos utilities?
Continue reading Is principal type supported in Linux Kerberos utilities?
I’m working with an organization that’s integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren’t a lot of scenarios where an admin account on one… Continue reading Risks for implementing single sign on
I’m playing with golden ticket (mimikatz)
kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,501,513,512,520,518,519 /… Continue reading How do I lookup the UID of a domain user?
I’m playing with golden ticket (mimikatz)
kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,501,513,512,520,518,519 /… Continue reading How do I lookup the UID of a domain user?
In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC.
Since i would have to set up (… Continue reading LDAPS needed when using Kerberos?
I have observed that klist is used to list locally cached kerberos tickets. For golden tickets with indefinite expiry dates (say ~10 years), is it possible to list all the tickets submitted to a server?
That way we could loo… Continue reading Can klist be used to detect expiry dates for forged kerberos tickets?
I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions.
As far as I know, the KDC should be the one that chec… Continue reading How to update authorization information in a KDC dynamically?
I have configured a Cloudera cluster to use LDAP. If I add users into groups explicitly (i.e. user Test in GroupX) HDFS picks this up. However when I add GroupX to GroupY, Cloudera does not display this as a group that Test u… Continue reading Configure Cloudera group mapping to find nested users [on hold]
We have these devices that are trying to connect to a long dead Kerberos server from a long dead company, thus we don’t have access to the credentials.
I was trying to find a way for them to take a TGT without modifying the … Continue reading Kerberos – Forcing a successful TGT request
In March Patch Tuesday, Microsoft released a patch for CVE-2018-0886, a critical vulnerability that was discovered by Preempt. This vulnerability can be classified as a logical remote code execution (RCE) vulnerability. It resembles a classi… Continue reading From Public Key to Exploitation: How We Exploited the Authentication in MS-RDP