mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
67 lines
3.9 KiB
Markdown
67 lines
3.9 KiB
Markdown
# 88tcp/udp - Pentesting Kerberos
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|
|
|
|
## Basic Information
|
|
|
|
**Kerberos** inafanya kazi kwa kanuni ambapo inathibitisha watumiaji bila moja kwa moja kusimamia ufikiaji wao kwa rasilimali. Hii ni tofauti muhimu kwa sababu inasisitiza jukumu la itifaki katika mifumo ya usalama.
|
|
|
|
Katika mazingira kama **Active Directory**, **Kerberos** ni muhimu katika kuanzisha utambulisho wa watumiaji kwa kuthibitisha nywila zao za siri. Mchakato huu unahakikisha kwamba utambulisho wa kila mtumiaji unathibitishwa kabla ya kuingiliana na rasilimali za mtandao. Hata hivyo, **Kerberos** haipanui kazi zake ili kutathmini au kutekeleza ruhusa ambazo mtumiaji anazo juu ya rasilimali au huduma maalum. Badala yake, inatoa njia salama ya kuthibitisha watumiaji, ambayo ni hatua muhimu ya kwanza katika mchakato wa usalama.
|
|
|
|
Baada ya uthibitisho na **Kerberos**, mchakato wa kufanya maamuzi kuhusu ufikiaji wa rasilimali unakabidhiwa kwa huduma binafsi ndani ya mtandao. Huduma hizi zinawajibika kutathmini haki na ruhusa za mtumiaji aliyethibitishwa, kulingana na taarifa iliyotolewa na **Kerberos** kuhusu haki za mtumiaji. Muundo huu unaruhusu kutenganisha masuala kati ya kuthibitisha utambulisho wa watumiaji na kusimamia haki zao za ufikiaji, na kuwezesha njia yenye kubadilika na salama ya usimamizi wa rasilimali katika mitandao iliyosambazwa.
|
|
|
|
**Default Port:** 88/tcp/udp
|
|
```
|
|
PORT STATE SERVICE
|
|
88/tcp open kerberos-sec
|
|
```
|
|
### **Ili kujifunza jinsi ya kutumia Kerberos unapaswa kusoma chapisho kuhusu** [**Active Directory**](../../windows-hardening/active-directory-methodology/index.html)**.**
|
|
|
|
## Zaidi
|
|
|
|
### Shodan
|
|
|
|
- `port:88 kerberos`
|
|
|
|
### MS14-068
|
|
|
|
Kasoro ya MS14-068 inaruhusu mshambuliaji kubadilisha tokeni ya kuingia ya Kerberos ya mtumiaji halali ili kudai kwa uwongo mamlaka ya juu, kama vile kuwa Msimamizi wa Domain. Dai hili la uongo linathibitishwa kwa makosa na Msimamizi wa Domain, likiwezesha ufikiaji usioidhinishwa wa rasilimali za mtandao katika msitu wa Active Directory.
|
|
|
|
{{#ref}}
|
|
https://adsecurity.org/?p=541
|
|
{{#endref}}
|
|
|
|
Mizengwe mingine: [https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek](https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek)
|
|
|
|
## HackTricks Amri za Otomatiki
|
|
```
|
|
Protocol_Name: Kerberos #Protocol Abbreviation if there is one.
|
|
Port_Number: 88 #Comma separated if there is more than one.
|
|
Protocol_Description: AD Domain Authentication #Protocol Abbreviation Spelled out
|
|
|
|
Entry_1:
|
|
Name: Notes
|
|
Description: Notes for Kerberos
|
|
Note: |
|
|
Kerberos operates on a principle where it authenticates users without directly managing their access to resources. This is an important distinction because it underlines the protocol's role in security frameworks.
|
|
In environments like **Active Directory**, Kerberos is instrumental in establishing the identity of users by validating their secret passwords. This process ensures that each user's identity is confirmed before they interact with network resources. However, Kerberos does not extend its functionality to evaluate or enforce the permissions a user has over specific resources or services. Instead, it provides a secure way of authenticating users, which is a critical first step in the security process.
|
|
|
|
https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-kerberos-88/index.html
|
|
|
|
Entry_2:
|
|
Name: Pre-Creds
|
|
Description: Brute Force to get Usernames
|
|
Command: nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm="{Domain_Name}",userdb={Big_Userlist} {IP}
|
|
|
|
Entry_3:
|
|
Name: With Usernames
|
|
Description: Brute Force with Usernames and Passwords
|
|
Note: consider git clone https://github.com/ropnop/kerbrute.git ./kerbrute -h
|
|
|
|
Entry_4:
|
|
Name: With Creds
|
|
Description: Attempt to get a list of user service principal names
|
|
Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs
|
|
```
|
|
{{#include ../../banners/hacktricks-training.md}}
|