https://twitter.com/_nwodtuhs/status/1434523272700387330

#AD #Kerberos

Using Kerberos for Authentication Relay Attacks

https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html

#kerberos #relay

KerbMon

Continuous kerberoast monitor

https://github.com/Retrospected/kerbmon

#kerberos #monitor #pentest

pyKerbrute

Use Python to quickly brute force and enumerate valid Active Directory accounts through Kerberos Pre-Authentication (supports Pass-the-Hash)

https://github.com/3gstudent/pyKerbrute

#ad #kerberos #spray

How Windows Stops Kerberos Usernames Being Case Sensitive

https://vbscrub.com/2021/11/29/how-windows-stops-kerberos-usernames-being-case-sensitive/

#kerberos #pre_auth #aes_salt

Downgrading Kerberos Encryption & Why It Doesn’t Work In Server 2019

How we make Kerberos tickets use weaker encryption, the "TGT delegation trick", and why none of it works if the domain controllers are Windows Server 2019.

https://vbscrub.com/2021/12/04/downgrading-kerberos-encryption-amp-why-it-doesnt-work-in-server-2019/

#kerberos #windows2019 #pentest

ADenum

ADEnum is a pentesting tool that allows to find misconfiguration through the protocol LDAP and exploit some of those weaknesses with Kerberos.

https://github.com/SecuProject/ADenum

#ad #ldap #kerberos #enumeration #tools

KrbRelay

The only public tool for relaying Kerberos tickets and the only relaying framework written in C#.

https://github.com/cube0x0/KrbRelay

#ad #kerberos #relay

Relaying Kerberos over DNS using krbrelayx and mitm6

New method of gaining RCE on AD hosts in the same VLAN without credentials or needing NTLM, by abusing Kerberos, DNS and Active Directory Certificate Services.

https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/

#ad #kerberos #relay #mitm6

KrbRelayUp

Universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings)

https://github.com/Dec0ne/KrbRelayUp

#ad #privesc #kerberos #ldap #relay

🛡️Defending the Three Headed Relay

This blog discusses possible attack paths and various protections associated with Kerberos Relay activity.

https://jsecurity101.medium.com/defending-the-three-headed-relay-17e1d6b6a339

#ad #kerberos #relay #mitigation #blueteam

⚙️ No-Fix LPE Using KrbRelay with Shadow Credentials

This article will explain how to separate the shadow credential method that KrbRelayUp uses into multiple different steps, giving you a bit more control regarding how each piece executes. For example, we can reflectively load some pieces, and execute others normally

https://icyguider.github.io/2022/05/19/NoFix-LPE-Using-KrbRelay-With-Shadow-Credentials.html

#ad #privesc #kerberos #relay

🛠 S4fuckMe2selfAndUAndU2proxy — A low dive into Kerberos delegations

If you still do not understand the intricacies of Kebreros delegation, you should read this article.
This article covers details unconstrained delegation, constrained delegation, and resource-based constrained delegation, as well as recon and abuse techniques.

https://luemmelsec.github.io/S4fuckMe2selfAndUAndU2proxy-A-low-dive-into-Kerberos-delegations/

#ad #kerberos #delegations #article

🔑 Abuse Kerberos RC4 (CVE-2022-33679)

This blog post goes into detail on how Windows Kerberos Elevation of Privilege vulnerability works and how to force Kerberos to downgrade the encoding from the default AES encryption to the historical MD4-RC4. The vulnerability could allows an attacker to obtain an authenticated session on behalf of the victim and also lead to arbitrary code execution.

Research:
https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html

Exploit:
https://github.com/Bdenneu/CVE-2022-33679

#ad #kerberos #rc4 #exploit

☁️ Obtaining Domain Admin from Azure AD by abusing Cloud Kerberos Trust

In this blog we will look at how this trust can be abused by an attacker that obtains Global Admin in Azure AD, to elevate their privileges to Domain Admin in environments that have the Cloud Kerberos Trust set up. Since this technique is a consequence of the design of this trust type, the blog will also highlight detection and prevention measures admins can implement.

https://dirkjanm.io/obtaining-domain-admin-from-azure-ad-via-cloud-kerberos-trust

#ad #azure #kerberos #research

🔨KRBUACBypass

By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges.

Research:
https://www.tiraniddo.dev/2022/03/bypassing-uac-in-most-complex-way.html

Source:
https://github.com/wh0amitz/KRBUACBypass

#ad #kerberos #uac #bypass

🍅 S4UTomato — Escalate Service Account To LocalSystem via Kerberos

Learn how to leverage Kerberos for privilege escalation in a Windows domain environment using virtual accounts with the help of Resource-based Constrained Delegation, Shadow Credentials, and Tgtdeleg techniques.

https://github.com/wh0amitz/S4UTomato

#ad #privesc #kerberos #windows