We had gone through and examined this very traffic right here and understood the kind of request and reply that a domain controller was giving to a client whenever they were trying to log on to the Active Directory domain.
We understood what TGS was. We understood the Kerberos process and the whole back and forth between everything.
This leads us to wonder, can the session be stolen? Well, not exactly, but that brings us to where we're at right now, not previously.
We're taking a look and actually crafting and forging a request to the domain to be in accordance to what we see inside of our traffic as stated above.
This is known as a golden ticket attack. Basically, we're forging a Kerberos ticket granting ticket. I know these names are absolutely outstanding inside of the Active Directory world.
Basically, if we can forge this ticket granting ticket with just a TGT, then we can say the DC doesn't need to validate us for any further request that we may want to perform or ask about inside of the Active Directory domain.
We've got this golden ticket, you see, and it's going to give us the keys to the castle without any further hindrance or questioning.
Now, we can tell the network I'm the administrator with this magical ticket and basically get everything and anything that we want.
As we learned in the last skill, once we crack the Active Directory, we can actually go through to all of the subordinate systems inside of that Active Directory and basically do what we want.
Inside of an enterprise setup, let's say you have a forest with some subdomains and things like that. If you're an enterprise admin, you can even go further down and further across laterally inside of your organization.
This is where we get into persistence. That's right. That's where we're starting to wrap everything up here.
While we are looking at an Active Directory attack and specifically doing the golden ticket attack inside of this very skill here, we're really kind of honing in on the fact that we need to be gaining some persistence inside of the actual target that we're looking at.
It's okay for us to be able to go into an individual system, attack it, get the information, test the security, all sorts of great things.
But if the security administrators or like an IDS or an IPS find out about us and they plug the hole that was leaking that we were able to get into, then we have to find another way in.
Or we can use an attack like this to be able to gain some persistence and have a way to always come back inside of the actual Active Directory domain or even the organization itself.
Now the idea isn't just exclusive to Active Directory, you see. You can do this on individual systems if you wanted, because you can go through and create like a hidden account, create some service accounts, or create some weird shares.
Some way to where you have a way to be able to get back into the system itself after you've been kicked out or discovered the first time.
Now if you've been discovered the first time and nobody does anything about it and you're able to go back in the exact same way, one of two things has happened here.
Option one, that organization really needs to have a good talking to about their security posturing and making sure that holes in the security get fixed the moment that they're identified, whether you're in the course of a security test or not.
Option two, you've been sucked into a honeypot. They've left that hole open on purpose and wanted to see if you would come back to try to backtrace your steps to further prevent you, not just from using that account, but maybe even the full on subnet from where you're coming from. Congratulations, you got suckered.
Option three, there's not an option three. I can't really think of one. It kind of blends in between option one and two, which is why I added them together and got option three, which leads me to this.
It's usually one of those things somewhere in between. And as a pen tester, to gain persistence, you need to keep those two things in mind, understanding that you always need another way in.
It's not exactly the same way you did the first time, so that way you don't find yourself trapped inside of a closing box of the security admins always finding you.
Now, look, I get it, security admins. I know you're watching this thinking, but it's our job to catch them and make sure that they can't get access to anything.
You're absolutely correct. And the more that you prevent me from coming inside and gaining access to your organization and gaining that persistence of always returning, the better you're doing your job. Kudos to you.
It's the cat and mouse game of pen testing and security administration.
This is more about understanding an attack that allows us to keep a foothold in an organization just in case we get caught doing something different the first time and we can always go back and try again.