Attacking Using Credential Cache Files
Next, we’ll turn our attention towards Credential Cache files, or ccache files.
We’ll consider two scenarios.
In the first scenario, if we compromise an active user’s shell session,
we can essentially act as the user in question
and use their current Kerberos tickets.
Gaining an initial TGT would require the user’s Active Directory password.
However, if the the user is already authenticated,
we can just use their current tickets.
The second scenario is to authenticate by compromising a user’s ccache file.
As we demonstrated earlier, a user’s ccache file is stored in /tmp
and uses a specific format.
The file is typically only accessible by the owner.
If we have privileged access and don’t want to log in as the user in question,
or we are able to read the user’s files but don’t have direct shell access,
we can still copy the victim’s ccache file and load it as our own.
Let’s explore this in greater detail.
First, we’ll ssh to the linuxvictim machine as the offsec user
who has sudo permissions.
We can then list the ccache files in /tmp.
We can locate the domain administrator’s ccache file
by inspecting the file’s owner.
Let’s copy the domain administrator’s ccache file,
and set the ownership of the new file to our offsec user.
In order to use the ccache file,
we need to set the environment variable we discussed earlier.
This variable gives the path of the credential cache file
so that Kerberos utilities can find it.
We’ll clear our old credentials,
set the variable and point it to our newly-copied ccache file,
then list our available tickets with klist.
Based on the output,
we now have the administrator user’s TGT in our credential cache,
and we can request service tickets on their behalf.
Now that we have the user’s Kerberos tickets,
we can use those tickets to authenticate to services
that are Kerberos-enabled on the user’s behalf.
In the next section, we’ll discuss using Impacket to do this.