๐ Secure Bits ๐ก
๐๐ผ๐ ๐๐ฒ๐ฟ๐ฏ๐ฒ๐ฟ๐ผ๐ ๐ช๐ผ๐ฟ๐ธ๐ โ ๐ถ๐ป ๐๐ถ๐บ๐ฝ๐น๐ฒ ๐๐ผ๐ฟ๐ฑ๐.
If youโre managing Windows environments, you need to really understand Kerberos. Because without it, you are not fully aware of the ways to protect Kerberos authentication protocol and thus your environment.
๐ ๐ณ๐ฒ๐ ๐พ๐๐ถ๐ฐ๐ธ ๐ณ๐ฎ๐ฐ๐๐:
โก๏ธ You canโt use IP addresses by default.
โก๏ธ Thereโs a dangerous attack called Kerberoasting.
โก๏ธ Multiple encryption steps happen silently in the background.
Kerberos comes from Cerberus โ the ๐๐ต๐ฟ๐ฒ๐ฒ-๐ต๐ฒ๐ฎ๐ฑ๐ฒ๐ฑ ๐ฑ๐ผ๐ด from Greek mythology.
๐ช๐ต๐? ๐๐ฒ๐ฐ๐ฎ๐๐๐ฒ ๐๐ฒ๐ฟ๐ฏ๐ฒ๐ฟ๐ผ๐ ๐๐๐ฒ๐ ๐ฎ ๐๐ต๐ฟ๐ฒ๐ฒ-๐๐ฎ๐ ๐๐ฟ๐๐๐:
๐ค The Client
๐๏ธ The Key Distribution Center (KDC)(DC)
๐ ๏ธ The Target Service
Hereโs the full handshake:
1๏ธโฃ Login โ You enter your credentials. Thatโs a KRB_AS_REQ โ request for a TGT (Ticket Granting Ticket).
2๏ธโฃ KDC validates your identity and returns the TGT in a KRB_AS_REP.
Youโre authenticated, but not authorized yet.
Think of it like scanning your Costco card โ you’re in the store, but you havenโt bought anything yet.
3๏ธโฃ Now you want to access a service โ You request a TGS ticket with KRB_TGS_REQ.
4๏ธโฃ KDC sends it back โ KRB_TGS_REP.
5๏ธโฃ You present the TGS to the service.
6๏ธโฃ If everything checks out, access is granted.
But ๐ต๐ผ๐ does it actually work?
Because parts of these tickets are ๐ฒ๐ป๐ฐ๐ฟ๐๐ฝ๐๐ฒ๐ฑ ๐๐๐ถ๐ป๐ด ๐๐ต๐ฒ ๐ฝ๐ฎ๐๐๐๐ผ๐ฟ๐ฑ-๐ฑ๐ฒ๐ฟ๐ถ๐๐ฒ๐ฑ ๐ธ๐ฒ๐๐ of the parties involved.
For example:
When you authenticate, your system ๐ฒ๐ป๐ฐ๐ฟ๐๐ฝ๐๐ ๐ฎ ๐๐ถ๐บ๐ฒ๐๐๐ฎ๐บ๐ฝ as a part of the request for TGT using ๐๐ผ๐๐ฟ ๐ฝ๐ฎ๐๐๐๐ผ๐ฟ๐ฑ-derived key.
The KDC tries to decrypt it using your actual ๐ฝ๐ฎ๐๐๐๐ผ๐ฟ๐ฑ ๐ณ๐ฟ๐ผ๐บ ๐๐
โก๏ธ If it works, youโre legit.
When accessing a service, the TGS includes a part that ๐ผ๐ป๐น๐ ๐๐ต๐ฒ ๐๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ ๐ฐ๐ฎ๐ป ๐ฑ๐ฒ๐ฐ๐ฟ๐๐ฝ๐ using its own password.
โก๏ธ If it can decrypt it, it trusts you โ because ๐ถ๐ ๐๐ฟ๐๐๐๐ ๐๐ต๐ฒ ๐๐๐ that issued it.
Thatโs the magic of Kerberos โ ๐ฑ๐ฒ๐น๐ฒ๐ด๐ฎ๐๐ฒ๐ฑ ๐๐ฟ๐๐๐ ๐๐ถ๐๐ต๐ผ๐๐ ๐ฑ๐ถ๐ฟ๐ฒ๐ฐ๐ ๐ฐ๐ผ๐บ๐บ๐๐ป๐ถ๐ฐ๐ฎ๐๐ถ๐ผ๐ป.
Interesting, right?
โ๏ธ If you want to dive deeper into the protocol, attacks like Kerberoasting, and real-world tips โ I created a ๐ณ๐ฟ๐ฒ๐ฒ ๐ฐ๐ผ๐๐ฟ๐๐ฒ ๐ผ๐ป ๐๐ฒ๐ฟ๐ฏ๐ฒ๐ฟ๐ผ๐ ๐ถ๐ป ๐บ๐ ๐๐ฐ๐ฎ๐ฑ๐ฒ๐บ๐:
https://academy.horizon-secured.com/p/windows-infrastructure-security-kerberos
Next time I will explain the attack – ๐๐ฒ๐ฟ๐ฏ๐ฒ๐ฟ๐ผ๐ฎ๐๐๐ถ๐ป๐ด.
