Stealing Keytab Files
One way to allow automated scripts to access Kerberos-enabled network resources
on a user’s behalf is through the use of keytab files.
Keytab files contain a Kerberos principal name and encrypted keys.
These allow a user or script to authenticate to Kerberos resources
elsewhere on the network
on the principal’s behalf without entering a password.
For example, let’s assume a user wants to retrieve data from an MSSQL database
via an automated script using Kerberos authentication.
The user could create a keytab file for the script
to authenticate to the server with their credentials
and then retrieve the information on their behalf.
Keytab files are commonly used in cron scripts
when Kerberos authentication is needed to access certain resources.
We can examine the contents of files like /etc/crontab to determine which scripts
are being run and then examine those scripts to see whether they are using
keytabs for authentication.
Paths to keytab files used in these scripts may also reveal which users are
associated with which keytabs.
Let’s create a sample demonstration keytab for our domain Administrator.
We’ll create it with ktutil, which generates an interactive prompt.
Then we use addent to add an entry to the keytab file for the administrator user,
and specify the encryption type with -e.
The utility asks for the user’s password, which we provide.
We then use wkt with a path to specify where the keytab file should be written.
Finally, we can exit the utility with the quit command.
This keytab file grants domain administrator rights to scripts or users
that have read access to it.
For example, if we’ve gained root access to this box,
and discover this keytab file,
we can use it maliciously to gain access to other systems
as the domain administrator.
To use the file as the root user, we will use kinit with this syntax,
passing the keytab file with the -t option.
Using the klist command,
we can verify that the tickets from the keytab have been loaded into our
root account’s credential cache file.
If it’s been a while since the tickets were created, they may have expired.
However, if it’s within the renewal timeframe,
we can renew it without entering a password
using kinit with the -R flag.
Normally, keytab files would be written somewhere safe
such as the user’s home folder.
In our case, since we’ve compromised the server entirely
and have root access, the location wouldn’t matter.
Now that our root user has the keytab files loaded,
we can authenticate as the domain admin,
granting us access to any resources they have access to.
Let’s attempt to access the domain controller’s C drive.
Success!
We can use our stolen keytab to access the domain controller
using Kerberos authentication.