Collaborate Disseminate
Currently looking for a way to prevent unauthenticated user enumeration on a Domain Controller. This is a security precaution I’d like to implement, next to the existing measures taken prevent unauthorized DC access.
Kerbrute states the fo… Continue reading Is it possible to prevent Kerbrute from unauthenticated user enumation Active Directory?
An Active Directory domain is deployed, a domain controller on Windows Server 2019. A computer with SQL Server 2016 is added to it, which is launched under the srv service account. The attacker has unprivileged access to this SQL Server fr… Continue reading Equivalence of UNC Path Injection and Kerberoasting Attacks on SQL Server
I’m playing with mimikatz kerberos::golden, e.g.,
kerberos::golden /domain:XXX /sid:XXX /user:XXX /aes256:XXX /endin:864000 /renewmax:10240 /ptt
Then I tried to access a domain joined machine, but I got access denied:
dir \\IP_address\C$
… Continue reading Kerberos golden ticket works with DNS only – access denied with IP address
Microsoft describes the communication steps to receive a TGS as follows:
client asks Kerberos DC for Ticket Granting Ticket
client receives TGT (if authenticated successfully)
client asks KDC for Ticket Granting Service, to get access to … Continue reading Kerberos Ticket Granting Service TGS – order of communication steps
In a containerized environment, what would be the most appropriate way of configuring Kerberos caches?
I am trying to activate SingleSignOn for a new browser-based application hosted on a server by us, which we implemented at work recently. The application works flawlessly, the only thing that doesn’t seem to work is the SingleSignOn servic… Continue reading I am trying to configure SingleSignOn (Kerberos) and get 2 error messages in the log. Even google hasn’t heard of them
I’m trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I’ve seen say the initial request is partially encrypted using the client’s password. First, what i… Continue reading How is the initial request made to the Access Server in Kerberos?
Is it possible to gain code execution on a machine through access to CIFS service? And if so, how? In my case, I have a valid Kerberos TGS to CIFS service running on a host and I am able to copy and download files. I want to get a shell au… Continue reading How to gain code execution through access to CIFS service on Windows?
I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved.
After an interactive logon with kerberos, you will have in the cached credentials both kerberos tickets and ntlm hashes. I figured wi… Continue reading How NTLM SSO is preformed on smartcard Kerberos logon?
On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the domain controller. The logon type was remot… Continue reading What is a secure way to log onto the domain controller?