Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Precious Gemstones: The New Generation of Kerberos Attacks

Summary: Unit 42 researchers describe two newer Kerberos ticket attacks, Sapphire and Diamond, that both decrypt a legitimate TGT and modify its PAC, requiring access to the KRBTGT account's password hash. Sapphire, introduced by Charlie Bromberg, uses U2U plus S4U2Self to obtain a high-privileged user's PAC and swap it into a low-privileged user's TGT, while Diamond, introduced by Charlie Clark and Andrew Schwartz, modifies the requested TGT's own PAC to add privileges or change the cname.

What you should know: Because these attacks alter a TGT that a legitimate domain controller actually issued, the common Golden Ticket detection based on a missing TGT creation no longer applies, and a single KRBTGT hash yields unconstrained access to all services and resources in the domain plus persistence. Forged ticket attacks have already been seen in the wild, including by Playful Taurus (APT15, Ke3chang, NICKEL), a China-attributed group that has targeted oil, government, diplomatic, military and non-governmental organizations worldwide since 2010.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related