In our challenge we set out to figure out when a POSIX based system like our Ubuntu system inside of our lab tries to connect to Active Directory for a resource like a SMB share.
What authentication method are we using inside of Active Directory?
Well I'm glad you asked because we're going to swap on over and you can see that in Ubuntu I have the command ready to go to mount this share.
Before it asks me for authentication and great stuff like that.
Now 0.49 is the domain controller and I have on the domain controller itself a DC share.
We're going to be using the administrator account to be able to connect to this.
But before we do so I want to go ahead and restart the actual Fireshark for us to be able to figure out what authentication method is being used.
So now that I have it running let's go on over to our Ubuntu system and go ahead and type in the password for the DC share which is piet.dollar.word.
Permission denied.
And give me one second and go in here and we can see if we're actually connected to it. We are.
And make sure that I actually type this in correctly.
Scroll back up and take out the Texas side to it because I may be goofing that up.
Okay.
piet.dollar.word.
Whoops I got used to a local login there for a second so I actually modified the command and left my error so that way you can see what I did.
And I will be putting this command in the command box below but now we're actually identifying that we're connected to a domain, texas.local along with the username of administrator.
And I have Wireshark running on the actual DC itself.
So as we do this we can say piet.dollar.word and we have connected.
Now let me go over here and actually stop this real quick.
And for a verification purpose real quick, ifconfig, you can see that this is IP address 192.168.0.55.
So we can just simply do filter by ip.address 192.168.0.55.
And you can see here that we have a lot of different SMB2 commands.
So what was this? Was this Kerberos or NTLM?
Well let's verify just real quick as well because if you remember up above that I have in the previous section filtering for NTLM.
This is just filtering for the address that we have inside of Wireshark that was making that connection and we see SMB2.
Well let's go through and see did we tcp.port equal equal 445.
And it's all SMB2 again.
So just out of curiosity tcp.port equal equal 88.
And nothing.
One last check just a verification for us real quick.
Nothing in Kerberos.
Which means that we were using NTLM version 2.
And we went through the authentication method inside of the previous portion of the skill above.
And the reason I'm pointing all this out is because as we progress through the skills together we're going to see why knowing about Kerberos and NTLM authentication methods and how they interact with Active Directory works in the grand scheme of things.
Now yes I know this is pretty simple straightforward and basically refreshing a lot of things that we've learned along the way as security technicians and pen testers.
But being that Active Directory is one of the most common domain types that you'll run across for whatever reason.
And knowing that there are POSIX based systems out there.
And I wanted to make sure that we truly understood the actual authentication method that is Kerberos and NTLM.
Because different scenarios require different types of login.
Now you will be able to go through the labs and see for yourselves based on the same files and the examples that we have in the skill already.
The difference between the two and how quick and easy one is compared to the other.
Kerberos has way more verification process in it than NTLM does.
Which makes NTLM just a teeny bit weaker in terms of actual security.
And as a pen tester these are the things that we want to point out.
Making sure that the organization that we're pen testing for understands that we have NTLM traffic going on.
Can we enforce Kerberos over NTLM?
It is possible even in that POSIX based system environment but it's elbow to the foot type thing.
So we try to limit as much as possible.
And one of the giveaways that this was also NTLM was the fact that I invoked the mount share through the actual IP address itself.
Which is something we covered under NTLM.
Now there's a whole lot more that we're going to be covering for Active Directory in general.
But I just wanted to get the basic understanding of authentication out of the way.
So that way as we continue we have a foundational platform to build off of.
I hope this has been informative for you and I'd like to thank you for viewing.
Thank you.