What is the default domain authentication protocol in Windows since Server 2000, replacing NTLM?
Kerberos.
What central, trusted server authenticates principals in a Kerberos system?
The Key Distribution Center (KDC).
In a Windows domain, what server role acts as the Kerberos Key Distribution Center (KDC)?
The domain controllers.
What are the three sub-components of the Key Distribution Center (KDC)?
A principal database, an Authentication Server (AS), and a Ticket Granting Server (TGS).
What is a Ticket Granting Ticket (TGT)?
A ticket provided to a principal by the Authentication Server (AS) after identity verification, used to request service tickets without re-entering a password.
What uniquely identifies each service instance in Kerberos?
A Service Principal Name (SPN).
What is the typical format of a Service Principal Name (SPN)?
class/instance:port.
How does a principal request access to a service using Kerberos after obtaining a TGT?
It requests a service ticket from the Ticket Granting Server (TGS) component of the KDC.
What is another colloquial name for a Kerberos ‘service ticket’?
A TGS ticket or ticket granting service ticket.
What is a Privileged Attribute Certificate (PAC)?
A structure attached to a Kerberos ticket containing additional information about a principal, such as group memberships and user rights.
What is the primary benefit of a service using the information within a PAC?
The service can determine a user’s privileges without needing to query Active Directory, which improves network performance.
What message does a client send to the KDC to request a new TGT?
A Kerberos Authentication Service Request (AS-REQ).
What is the target service’s name when a client requests a Ticket Granting Ticket (TGT)?
krbtgt.
What is the most common pre-authentication mechanism used by a Kerberos client in an AS-REQ?
An encrypted timestamp, where the current time is encrypted with a hash derived from the principal’s password.
After a successful pre-authentication, what message does the KDC send back to the client?
An Authentication Service Reply (AS-REP).
The part of an AS-REP message that contains a copy of the logon session key encrypted with the principal’s secret is called the _____.
EncASRepPart.
The Kerberos attack known as AS-REP Roasting involves cracking which part of the AS-REP message?
The EncASRepPart, to recover the user’s plaintext password.
What is the purpose of the ‘authenticator’ included in a TGS-REQ message?
It proves the TGS-REQ is from the genuine principal, as it is encrypted with the logon session key that is never transmitted in the clear.
With what key does a client encrypt the ‘authenticator’ in a TGS-REQ message?
The principal’s current logon session key.
Upon receiving a TGS-REQ, what must the KDC decrypt first to recover the logon session key and validate the request?
The Ticket Granting Ticket (TGT), using the krbtgt account’s hash.
The Kerberos attack known as ‘Kerberoasting’ involves cracking which part of the TGS-REP message?
The EncTicketPart of the service ticket, which is encrypted with the service account’s secret.
What two items does a client use to access a service in the final Client/Server Authentication Exchange?
The service ticket and the associated service session key.
The final authentication messages (AP-REQ/AP-REP) are embedded inside the underlying service protocol, facilitated by what mechanism on Windows?
The Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO).
What is the purpose of mutual authentication in the client/server exchange?
It proves to the client that it is communicating with the legitimate service, as only that service can decrypt the authenticator and correctly respond.
-
Module 144
-
Module 243
-
Module 360
-
Module 466
-
Module 550
-
Module 660
-
Module 762
-
Module 856
-
Module 918
-
Module 1052
-
Module 1153
-
Module 1250
-
Module 1336
-
Module 1441
-
Module 1567
-
Module 1653
-
Module 1728
-
Module 1851
-
Module 1954
-
Module 2022
-
Cobalt Strike User Guide161
-
Cobalt Strike Installation Guide37
