Kerberos inafanya kazi kwa kanuni ambapo inathibitisha watumiaji bila kusimamia moja kwa moja ufikiaji wao kwa rasilimali. Hii ni tofauti muhimu kwa sababu inasisitiza jukumu la itifaki katika mifumo ya usalama.
Katika mazingira kama Active Directory, Kerberos ni muhimu katika kuanzisha utambulisho wa watumiaji kwa kuthibitisha nywila zao za siri. Mchakato huu huhakikisha kuwa utambulisho wa kila mtumiaji unathibitishwa kabla ya kuingiliana na rasilimali za mtandao. Walakini, Kerberos haiongezi utendaji wake wa kutathmini au kutekeleza ruhusa ambazo mtumiaji anayo juu ya rasilimali au huduma maalum. Badala yake, inatoa njia salama ya kuthibitisha watumiaji, ambayo ni hatua muhimu sana katika mchakato wa usalama.
Baada ya kuthibitishwa na Kerberos, mchakato wa kufanya maamuzi kuhusu ufikiaji wa rasilimali unatekelezwa na huduma binafsi ndani ya mtandao. Huduma hizi ndizo zinazohusika na kutathmini haki na ruhusa za mtumiaji aliye thibitishwa, kulingana na habari zinazotolewa na Kerberos kuhusu mamlaka ya mtumiaji. Muundo huu unaruhusu kugawanyika kwa majukumu kati ya kuthibitisha utambulisho wa watumiaji na kusimamia haki zao za ufikiaji, kuruhusu njia inayoweza kubadilika na salama zaidi ya usimamizi wa rasilimali katika mtandao uliogawanyika.
Bandari ya Chaguo: 88/tcp/udp
PORT STATE SERVICE
88/tcp open kerberos-sec
Ili kujifunza jinsi ya kutumia Kerberos vibaya, unapaswa kusoma chapisho kuhusuActive Directory.
Zaidi
Shodan
port:88 kerberos
MS14-068
Kosa la MS14-068 linaruhusu mtu kudukua alama ya kuingia ya Kerberos ya mtumiaji halali ili kudai vibali vilivyoinuliwa, kama kuwa Domain Admin. Dai hili bandia linathibitishwa kimakosa na Domain Controller, kuruhusu ufikiaji usiohalali kwa rasilimali za mtandao katika msitu wa Active Directory.
Protocol_Name: Kerberos #Protocol Abbreviation if there is one.
Port_Number: 88 #Comma separated if there is more than one.
Protocol_Description: AD Domain Authentication #Protocol Abbreviation Spelled out
Entry_1:
Name: Notes
Description: Notes for Kerberos
Note: |
Kerberos operates on a principle where it authenticates users without directly managing their access to resources. This is an important distinction because it underlines the protocol's role in security frameworks.
In environments like **Active Directory**, Kerberos is instrumental in establishing the identity of users by validating their secret passwords. This process ensures that each user's identity is confirmed before they interact with network resources. However, Kerberos does not extend its functionality to evaluate or enforce the permissions a user has over specific resources or services. Instead, it provides a secure way of authenticating users, which is a critical first step in the security process.
https://book.hacktricks.xyz/pentesting/pentesting-kerberos-88
Entry_2:
Name: Pre-Creds
Description: Brute Force to get Usernames
Command: nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm="{Domain_Name}",userdb={Big_Userlist} {IP}
Entry_3:
Name: With Usernames
Description: Brute Force with Usernames and Passwords
Note: consider git clonehttps://github.com/ropnop/kerbrute.git ./kerbrute -h
Entry_4:
Name: With Creds
Description: Attempt to get a list of user service principal names
Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs
