Roasting the three-headed dog
It was inevitable that we would reach a point where we must discuss and understand Kerberos. This authentication protocol was built to access services in the network by presenting a valid ticket.
Kerberos 101
We need a bit more of an understanding of how the protocol works before we can discuss the attack venues available for us. As a good starting point, I can recommend the blog post by hackndo[17]
We have three main subjects – the client, service, and Key Distribution Center (KDC), which is the domain controller. The following diagram[18], which was published on the Microsoft website, explains how it works:
Figure 4.8 – Kerberos in a nutshell
Now let follow the authentication process in more details step-by-step.
- KRB_AS_REQ (Kerberos Authentication Service Request) is sent by the client to KDC and contains various information, most importantly, a timestamp that is encrypted with the hashed...
