Pass-the-ticket and overpass-the-hash
Steal or forge a Kerberos ticket and inject it into memory: the session becomes the victim's, with no password.
notes on hacking and technology
|
main menu
user menu
topics
|
latest postsGolden and Silver Ticket: forging KerberosWith the krbtgt account hash you forge arbitrary TGTs (golden). With a service account hash, TGS tickets for that service (silver). AS-REP roasting: accounts without pre-authenticationIf an account has Kerberos pre-authentication disabled, anyone gets a blob encrypted with its password to crack offline. NTLM relay: forwarding the authentication elsewhereDo not crack the hash: forward the whole NTLM authentication to another service and authenticate as the victim. DCSync: asking the domain controller for the hashesWith replication rights, an attacker impersonates a DC and requests credential replication — including the krbtgt hash. Unconstrained delegation: TGTs handed overA host with unconstrained delegation receives the TGT of anyone who authenticates to it, and can reuse it anywhere. Compromising it compromises them all. LSASS dumping: credentials in memoryThe LSASS process holds hashes and sometimes cleartext passwords. Dumping its memory is the first step of nearly every lateral movement. UAC bypass: from admin to elevatedUAC is not a security boundary per Microsoft. Auto-elevating tasks and registry hijacks go from medium to high integrity without a prompt. BloodHound: attack paths in the domainA graph of users, groups and permissions reveals the shortest chain from any account to Domain Admin. The PE format: anatomy of a Windows executableHeaders, sections, import table. Understanding the PE is the prerequisite to analyze malware and to see where injected code hides. Process injection: running code in another processAllocate memory in a remote process, write code into it, start it. The basis of process masquerading and evasion. DLL hijacking: the library loaded from the wrong placeWindows searches for DLLs in an order. Planting a malicious one where it is found before the real one runs your code. |
latest posts
your IP address:
216.73.216.108
visitor #1
MOTD:
Every abstraction leaks somewhere. Here we look at where. |
topics