Using Kerberos with Impacket
Impacket is a set of tools
used for low-level manipulation of network protocols
and exploiting network-based utilities.
This toolset can also be used to abuse Kerberos on Linux
and is available in Kali.
One popular module from Impacket is psexec.
This module is similar to Microsoft Sysinternal’s psexec utility.
It allows us to perform actions on a remote Windows host.
In order to use Impacket utilities in our lab environment from our Kali VM,
we need to do some initial setup.
This will configure our Kali VM to be able to connect
to the Kerberos environment properly.
In the scenario described in this section,
we assume that we have compromised a domain joined host,
specifically linuxvictim,
and stolen a ccache file.
Rather than perform any lateral movement from the linuxvictim box,
we’ll execute our attack directly from our Kali system with Impacket.
To do so, we’ll first need to copy
our victim’s stolen ccache file to our Kali VM,
and set the environment variable as we did previously on linuxvictim.
We can use the same ccache file as the last example.
As before, this will allow us to use the victim’s Kerberos tickets as our own.
We’ll then need to install the Kerberos linux client utilities.
This will allow us to perform our ticket manipulation tasks
that we performed earlier on our linuxvictim VM,
but now from our Kali VM.
When prompted for a kerberos realm, we’ll enter “corp1.com”.
This lets the Kerberos tools know which domain we’re connecting to.
We’ll need to add the domain controller IP
to our Kali VM to resolve the domain properly.
We can get the IP address of the domain controller from the linuxvictim VM.
Now that the client utilities are installed, the target domain controller
(dc01.corp1.com) and the generic domain (corp1.com)
need to be added to our /etc/hosts file.
This allows Kerberos to properly resolve the domain names
for the domain controller.
In order to use our Kerberos tickets,
we will need to have the correct source IP,
which in this case is the compromised linuxvictim host
that is joined to the domain.
Because of this, we’ll need to setup a SOCKS proxy on linuxvictim
and use proxychains on Kali
to pivot through the domain joined host when interacting with Kerberos.
To do so, we’ll need to comment out the line for proxy_dns
in /etc/proxychains.conf
to prevent issues with domain name resolution while using proxychains.
Once these settings are in place,
we need to set up a SOCKS server
using ssh on the server we copied the ccache file from,
which in our case is linuxvictim.
The -D parameter specifies the port we’ll be using for proxychains
(which is defined in /etc/proxychains.conf)
in order to tunnel Kerberos requests.
Impacket has several scripts available
that will help us enumerate and exploit Active Directory.
For example, we can examine the list of domain users with GetADUsers.py.
The output contains a list of the domain users.
We can also retrieve a list of the SPNs available to our Kerberos user.
This time the output contains the list of SPNs available.
If we want to gain a shell on the server, we can then run psexec with this command.
Using Impacket’s psexec module and our stolen Kerberos tickets,
we are now SYSTEM on the domain controller
and can do whatever we please.
As we’ve demonstrated, Kerberos functionality
on Linux can provide an excellent attack vector
for compromising a domain
and moving laterally within the network.
Knowing how Linux handles Kerberos authentication
and how to exploit it
can make a significant difference in a penetration test.