Last updated
Last updated
The CIFS service can be leveraged for listing and transferring files, but what if port 445 was unavailable or we wanted an option for lateral movement?
In the Kerberos authentication protocol, a service validates an inbound ticket by ensuring that it's encrypted with that service's symmetric key. This key is derived from the password hash of the principal running the service. Most services run in the SYSTEM context of a computer account, e.g. SQL-2$. Therefore, all service tickets, whether they be for CIFS, TIME, or HOST, etc, will be encrypted with the same key. The SPN does not factor into ticket validation.
Furthermore, the SPN information in the ticket (i.e. the sname field) is not encrypted and can be changed arbitrarily. That means we can request a service ticket for a service, such as CIFS, but then modify the SPN to something different, such as LDAP, and the target service will accept it happily.
This was originally discovered by and confirmed as "by design" by Microsoft.
We can be abuse this using /altservice flag in Rubeus. In this example, I'm using the same TGT for SQL-2 to request a TGS for LDAP instead of CIFS.
Against a domain controller, the LDAP service allows us to perform a dcsync.