Last updated
Last updated
In the previous examples, we leveraged both plaintext credentials (with Impacket & runas /netonly) and NTLM (with Mimikatz) to authenticate to resources over the SOCKS proxy. However, it is possible to use Kerberos tickets as well. Using Impacket through proxychains is a popular way to do this.
First, let's use getTGT.py to request a TGT for jking with their AES256 hash.
Note that you should use the fully qualified domain name, dev.cyberbotic.io rather than the NetBIOS name, DEV.
This will automatically output the ticket in ccache format which can be used with other Impacket scripts. However, we must first create an environment variable called KRB5CCNAME that will point to the ccache file.
Now we can use psexec.py to get a SYSTEM shell on WEB.
If you have a ticket in kirbi format obtained with another tool, it can be converted to ccache format for use with Impacket. For example, here I'm using the TGT delegation trick to get a usable TGT for bfarmer from a non-elevated session.
Base64 decode the ticket and write it to bfarmer.kirbi.
Then convert it using ticketConverter.py.
This tool can also convert from ccache to kirbi.
Now let's use this TGT to interact with the SQL-2 service.
This may require adding a static host entry to /etc/hosts and changing the proxy_dns setting in /etc/proxychains.conf to remote_dns.
Kerberos tickets can also be leveraged from the Windows attacker machine. The first step is to add *.cyberbotic.io your Proxifier proxification rule(s). This is because Kerberos uses hostnames rather than IP addresses and Proxifier won't proxy Kerberos traffic unless the domains are explicitly set in the rules.
Next, launch an instance of cmd.exe or powershell.exe using runas /netonly with a valid domain username, but a fake password.
The spawned process will have no Kerberos tickets in its cache.
This method of pivoting prefers the presence of the correct service ticket(s) up front, rather than relying on a single TGT in the cache. If we want to access the SQL-2 service through HeidiSQL then we need a service ticket for the MSSQLSvc service. Let's use the TGT of bfarmer to do that (yes, requesting tickets through the proxy works as well).
Launch HeidiSQL from the same powershell window.
Set the target hostname to sql-2.dev.cyberbotic.io and connect.
