Pass the Ticket (PtT) from Linux
Last updated
Last updated
Although not common, Linux computers can connect to Active Directory to provide centralized identity management and integrate with the organization's systems, giving users the ability to have a single identity to authenticate on Linux and Windows computers.
A Linux computer connected to Active Directory commonly uses Kerberos as authentication. Suppose this is the case, and we manage to compromise a Linux machine connected to Active Directory. In that case, we could try to find Kerberos tickets to impersonate other users and gain more access to the network.
A Linux system can be configured in various ways to store Kerberos tickets. We'll discuss a few different storage options in this section.
Note: A Linux machine not connected to Active Directory could use Kerberos tickets in scripts or to authenticate to the network. It is not a requirement to be joined to the domain to use Kerberos tickets from a Linux machine.
Windows and Linux use the same process to request a Ticket Granting Ticket (TGT) and Service Ticket (TGS). However, how they store the ticket information may vary depending on the Linux distribution and implementation.
In most cases, Linux machines store Kerberos tickets as in the /tmp directory. By default, the location of the Kerberos ticket is stored in the environment variable KRB5CCNAME. This variable can identify if Kerberos tickets are being used or if the default location for storing Kerberos tickets is changed. These are protected by reading and write permissions, but a user with elevated privileges or root privileges could easily gain access to these tickets.
Another everyday use of Kerberos in Linux is with files. A is a file containing pairs of Kerberos principals and encrypted keys (which are derived from the Kerberos password). You can use a keytab file to authenticate to various remote systems using Kerberos without entering a password. However, when you change your password, you must recreate all your keytab files.
files commonly allow scripts to authenticate automatically using Kerberos without requiring human interaction or access to a password stored in a plain text file. For example, a script can use a keytab file to access files stored in the Windows share folder.
Note: Any computer that has a Kerberos client installed can create keytab files. Keytab files can be created on one computer and copied for use on other computers because they are not restricted to the systems on which they were initially created.
To practice and understand how we can abuse Kerberos from a Linux system, we have a computer (LINUX01) connected to the Domain Controller. This machine is only reachable through MS01. To access this machine over SSH, we can connect to MS01 via RDP and, from there, connect to the Linux machine using SSH from the Windows command line. Another option is to use a port forward. If you don't know how to do it, you can read the module .
Linux Auth from MS01 Image
As an alternative, we created a port forward to simplify the interaction with LINUX01. By connecting to port TCP/2222 on MS01, we will gain access to port TCP/22 on LINUX01.
Let's assume we are in a new assessment, and the company gives us access to LINUX01 and the user [email protected] and password Password2.
Linux Auth via Port Forward
Pass the Ticket (PtT) from Linux
realm - Check If Linux Machine is Domain Joined
Pass the Ticket (PtT) from Linux
The output of the command indicates that the machine is configured as a Kerberos member. It also gives us information about the domain name (inlanefreight.htb) and which users and groups are permitted to log in, which in this case are the users David and Julio and the group Linux Admins.
PS - Check if Linux Machine is Domain Joined
Pass the Ticket (PtT) from Linux
As an attacker, we are always looking for credentials. On Linux domain joined machines, we want to find Kerberos tickets to gain more access. Kerberos tickets can be found in different places depending on the Linux implementation or the administrator changing default settings. Let's explore some common ways to find Kerberos tickets.
A straightforward approach is to use find to search for files whose name contains the word keytab. When an administrator commonly creates a Kerberos ticket to be used with a script, it sets the extension to .keytab. Although not mandatory, it is a way in which administrators commonly refer to a keytab file.
Using Find to Search for Files with Keytab in the Name
Pass the Ticket (PtT) from Linux
Note: To use a keytab file, we must have read and write (rw) privileges on the file.
Another way to find keytab files is in automated scripts configured using a cronjob or any other Linux service. If an administrator needs to run a script to interact with a Windows service that uses Kerberos, and if the keytab file does not have the .keytab extension, we may find the appropriate filename within the script. Let's see this example:
Identifying Keytab Files in Cronjobs
Pass the Ticket (PtT) from Linux
In this example, we found a script importing a Kerberos ticket (svc_workstations.kt) for the user [email protected] before trying to connect to a shared folder. We'll later discuss how to use those tickets and impersonate users.
Note: As we discussed in the Pass the Ticket from Windows section, a computer account needs a ticket to interact with the Active Directory environment. Similarly, a Linux domain joined machine needs a ticket. The ticket is represented as a keytab file located by default at /etc/krb5.keytab and can only be read by the root user. If we gain access to this ticket, we can impersonate the computer account LINUX01$.INLANEFREIGHT.HTB
Reviewing Environment Variables for ccache Files.
Pass the Ticket (PtT) from Linux
As mentioned previously, ccache files are located, by default, at /tmp. We can search for users who are logged on to the computer, and if we gain access as root or a privileged user, we would be able to impersonate a user using their ccache file while it is still valid.
Searching for ccache Files in /tmp
Pass the Ticket (PtT) from Linux
As attackers, we may have several uses for a keytab file. The first thing we can do is impersonate a user using kinit. To use a keytab file, we need to know which user it was created for. klist is another application used to interact with Kerberos on Linux. This application reads information from a keytab file. Let's see that with the following command:
Listing keytab File Information
Pass the Ticket (PtT) from Linux
The ticket corresponds to the user Carlos. We can now impersonate the user with kinit. Let's confirm which ticket we are using with klist and then import Carlos's ticket into our session with kinit.
Note: kinit is case-sensitive, so be sure to use the name of the principal as shown in klist. In this case, the username is lowercase, and the domain name is uppercase.
Impersonating a User with a keytab
Pass the Ticket (PtT) from Linux
We can attempt to access the shared folder \\dc01\carlos to confirm our access.
Connecting to SMB Share as Carlos
Pass the Ticket (PtT) from Linux
Note: To keep the ticket from the current session, before importing the keytab, save a copy of the ccache file present in the environment variable KRB5CCNAME.
The second method we will use to abuse Kerberos on Linux is extracting the secrets from a keytab file. We were able to impersonate Carlos using the account's tickets to read a shared folder in the domain, but if we want to gain access to his account on the Linux machine, we'll need his password.
Extracting Keytab Hashes with KeyTabExtract
Pass the Ticket (PtT) from Linux
With the NTLM hash, we can perform a Pass the Hash attack. With the AES256 or AES128 hash, we can forge our tickets using Rubeus or attempt to crack the hashes to obtain the plaintext password.
Note: A keytab file can contain different types of hashes and can be merged to contain multiple credentials even from different users.
As we can see in the image, the password for the user Carlos is Password5. We can now log in as Carlos.
Log in as Carlos
Pass the Ticket (PtT) from Linux
Carlos has a cronjob that uses a keytab file named svc_workstations.kt. We can repeat the process, crack the password, and log in as svc_workstations.
To abuse a ccache file, all we need is read privileges on the file. These files, located in /tmp, can only be read by the user who created them, but if we gain root access, we could use them.
Once we log in with the credentials for the user svc_workstations, we can use sudo -l and confirm that the user can execute any command as root. We can use the sudo su command to change the user to root.
Privilege Escalation to Root
Pass the Ticket (PtT) from Linux
As root, we need to identify which tickets are present on the machine, to whom they belong, and their expiration time.
Looking for ccache Files
Pass the Ticket (PtT) from Linux
There is one user ([email protected]) to whom we have not yet gained access. We can confirm the groups to which he belongs using id.
Identifying Group Membership with the id Command
Pass the Ticket (PtT) from Linux
Julio is a member of the Domain Admins group. We can attempt to impersonate the user and gain access to the DC01 Domain Controller host.
To use a ccache file, we can copy the ccache file and assign the file path to the KRB5CCNAME variable.
Importing the ccache File into our Current Session
Pass the Ticket (PtT) from Linux
Note: klist displays the ticket information. We must consider the values "valid starting" and "expires." If the expiration date has passed, the ticket will not work. ccache files are temporary. They may change or expire if the user no longer uses them or during login and logout operations.
Most Linux attack tools that interact with Windows and Active Directory support Kerberos authentication. If we use them from a domain-joined machine, we need to ensure our KRB5CCNAME environment variable is set to the ccache file we want to use. In case we are attacking from a machine that is not a member of the domain, for example, our attack host, we need to make sure our machine can contact the KDC or Domain Controller, and that domain name resolution is working.
Host File Modified
Pass the Ticket (PtT) from Linux
We need to modify our proxychains configuration file to use socks5 and port 1080.
Proxychains Configuration File
Pass the Ticket (PtT) from Linux
Download Chisel to our Attack Host
Pass the Ticket (PtT) from Linux
Connect to MS01 via RDP and execute chisel (located in C:\Tools).
Connect to MS01 with xfreerdp
Pass the Ticket (PtT) from Linux
Execute chisel from MS01
Pass the Ticket (PtT) from Linux
Note: The client IP is your attack host IP.
Finally, we need to transfer Julio's ccache file from LINUX01 and create the environment variable KRB5CCNAME with the value corresponding to the path of the ccache file.
Setting the KRB5CCNAME Environment Variable
Pass the Ticket (PtT) from Linux
To use the Kerberos ticket, we need to specify our target machine name (not the IP address) and use the option -k. If we get a prompt for a password, we can also include the option -no-pass.
Using Impacket with proxychains and Kerberos Authentication
Pass the Ticket (PtT) from Linux
Note: If you are using Impacket tools from a Linux machine connected to the domain, note that some Linux Active Directory implementations use the FILE: prefix in the KRB5CCNAME variable. If this is the case, we need to modify the variable only to include the path to the ccache file.
Installing Kerberos Authentication Package
Pass the Ticket (PtT) from Linux
Default Kerberos Version 5 realm
The Kerberos servers can be empty.
Administrative Server for your Kerberos Realm
In case the package krb5-user is already installed, we need to change the configuration file /etc/krb5.conf to include the following values:
Kerberos Configuration File for INLANEFREIGHT.HTB
Pass the Ticket (PtT) from Linux
Now we can use evil-winrm.
Using Evil-WinRM with Kerberos
Pass the Ticket (PtT) from Linux
Impacket Ticket Converter
Pass the Ticket (PtT) from Linux
We can do the reverse operation by first selecting a .kirbi file. Let's use the .kirbi file in Windows.
Importing Converted Ticket into Windows Session with Rubeus
Pass the Ticket (PtT) from Linux
Just like Mimikatz, to take advantage of Linikatz, we need to be root on the machine. This tool will extract all credentials, including Kerberos tickets, from different Kerberos implementations such as FreeIPA, SSSD, Samba, Vintella, etc. Once it extracts the credentials, it places them in a folder whose name starts with linikatz.. Inside this folder, you will find the credentials in the different available formats, including ccache and keytabs. These can be used, as appropriate, as explained above.
Linikatz Download and Execution
Pass the Ticket (PtT) from Linux
We can identify if the Linux machine is domain joined using , a tool used to manage system enrollment in a domain and set which domain users or groups are allowed to access the local system resources.
In case is not available, we can also look for other tools used to integrate Linux with Active Directory such as or . Looking for those services running in the machine is another way to identify if it is domain joined. We can read this for more details. Let's search for those services to confirm if the machine is domain joined.
In the above script, we notice the use of , which means that Kerberos is in use. allows interaction with Kerberos, and its function is to request the user's TGT and store this ticket in the cache (ccache file). We can use kinit to import a keytab into our session and act as the user.
A credential cache or file holds Kerberos credentials while they remain valid and, generally, while the user's session lasts. Once a user authenticates to the domain, a ccache file is created that stores the ticket information. The path to this file is placed in the KRB5CCNAME environment variable. This variable is used by tools that support Kerberos authentication to find the Kerberos data. Let's look for the environment variables and identify the location of our Kerberos credentials cache:
We can attempt to crack the account's password by extracting the hashes from the keytab file. Let's use , a tool to extract valuable information from 502-type .keytab files, which may be used to authenticate Linux boxes to Kerberos. The script will extract information such as the realm, Service Principal, Encryption Type, and Hashes.
The most straightforward hash to crack is the NTLM hash. We can use tools like or to crack it. However, a quick way to decrypt passwords is with online repositories such as , which contains billions of passwords.
In this scenario, our attack host doesn't have a connection to the KDC/Domain Controller, and we can't use the Domain Controller for name resolution. To use Kerberos, we need to proxy our traffic via MS01 with a tool such as and and edit the /etc/hosts file to hardcode IP addresses of the domain and the machines we want to attack.
We must download and execute on our attack host.
Note: If you are not familiar with file transfer operations, check out the module .
To use with Kerberos, we need to install the Kerberos package used for network authentication. For some Linux like Debian-based (Parrot, Kali, etc.), it is called krb5-user. While installing, we'll get a prompt for the Kerberos realm. Use the domain name: INLANEFREIGHT.HTB, and the KDC is the DC01.
If we want to use a ccache file in Windows or a kirbi file in a Linux machine, we can use to convert them. To use it, we specify the file we want to convert and the output filename. Let's convert Julio's ccache file to kirbi.
is a tool created by Cisco's security team for exploiting credentials on Linux machines when there is an integration with Active Directory. In other words, Linikatz brings a similar principle to Mimikatz to UNIX environments.
