Skip to content

Kerberos on the wire

Scope: Network dimension only - not application-level ticket exploitation.

1. Context & stakes

Capture/relay Kerberos tickets at the network level.

Kerberos AS and TGS exchanges cross the wire, and whether captured material helps an attacker depends on the encryption type: legacy RC4 and DES tickets are brute-forceable offline, AES tickets are not. Purely at the network layer an eavesdropper harvests roastable material from weak enctypes and pre-auth. Enforcing AES enctypes and PKINIT removes the offline-crack payoff.

2. Theory

Kerberos authenticates via tickets from a KDC (AS-REQ/REP, TGS-REQ/REP) carried over the network. At the wire level the exposure is capture and relay of those exchanges/tickets, and pre-auth material usable for offline guessing. This module stays at the network dimension, not application-level ticket abuse.

3. Attack (PoC)

netlab-kerberos-net attack --i-own-this-network --iface veth-host
  1. Capture AS/TGS exchanges on the wire
  2. Ticket relay

4. Detection

netlab-kerberos-net detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • PKINIT, channel binding
  • Strong encryption, relay protection

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading