What is Kerberos?

• Kerberos is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
• Kerberos authentication is currently the default authentication technology used by Microsoft Windows, and there are Kerberos implementations in Apple OS, Linux, FreeBSD, ...

Possible Attacks against Kerberos

• Pass-the-ticket
• Golden Ticket
• Silver Ticket
• Credential stuffing / Brute Force
• DCShadow attack

How Kerberos works?

1. Client requests an authentication ticket (TGT).
2. The Key Distribution Center (KDC) verifies the credentials and sends back an encrypted TGT.
3. The client stores the TGT and when it expires the local session manager will request another TGT.
4. The client sends the current TGT to the Ticket Granting Service (TGS) with the Service Principal Name (SPN) of the resource the client wants to access.
5. TGS sends a valid session key for the service to the client.
6. Client forwards the session key to the service for access.