View source for Security/Dollar Ticket Attack

=The "Dollar Ticket Attack" / Name confusion in Kerberos=

This page attempts to document the "Dollar Ticket Attack" on Active Directory servers and targets (Kerberos enabled services).  

Many of these attacks are worse in Windows domains as [https://www.netspi.com/blog/technical/network-penetration-testing/machineaccountquota-is-useful-sometimes/ MachineAccountQuota] is still enabled by default.

== CVEs and Announcements of the Nov 2021 issues ==

* [https://www.samba.org/samba/security/CVE-2020-25717.html Samba CVE-2020-25717 A user in an AD Domain could become root on domain members]

* [https://www.samba.org/samba/security/CVE-2020-25719.html Samba CVE-2020-25719 Samba AD DC did not always rely on the SID and PAC in Kerberos tickets.]

* [https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041 Microsoft CVE-2021-42287 KB5008380—Authentication updates]

* [https://www.cert.govt.nz/it-specialists/advisories/critical-vulnerability-in-windows-kerberos-protocol/ CERT NZ Announcement of AD DC security issue and patch]

== Talks == 

* [https://sambaxp.org/archive SambaXP]: [https://www.youtube.com/watch?v=1BnraIAcybg The inside story on the dollar ticket attack - Youtube Video] [https://sambaxp.org/fileadmin/user_upload/sambaxp2022-Slides/Bartlett-Kerberos.pdf PDF] (longer)

* [https://www.kawaiicon.org Kawaiicon]: [https://youtu.be/4hBLf2vQc8k?t=30560 Live stream replay @ Youtube] [https://samba.org/~abartlet/Kawaiicon-2022-kerberos-smaller.pdf PDF without embedded video] (shorter, more focus on the remaining still open issues)

== Blogs ==

* [https://www.catalyst.net.nz/blog/stay-curious-dollar-ticket-security-issue Stay Curious: Lessons from the Dollar-ticket security issue]
* [https://www.catalyst.net.nz/blog/samba-team-fixes-microsoft-security-issue Catalyst Samba team fixes critical Microsoft security issue]

== Documentation ==

* [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/6435d3fb-8cf6-4df5-a156-1277690ed59c MS-KILE 3.3.5.6.1 Client Principal Lookup]
* [https://datatracker.ietf.org/doc/html/rfc4120 RFC 4120 The Kerberos Network Authentication Service (V5)]
* [https://www.rfc-editor.org/rfc/rfc6806.html RFC6806 Kerberos Principal Name Canonicalization and Cross-Realm Referrals]

* [https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/ Exploits]
* [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html Research]

=Still Open Issue in 'MIT Style' targets (Kerberos enabled services): =

For many 'MIT style' targets, it is trivial for a domain user to become root or another local privileged user.

==Fallback to 'bare' users==

Just as Samba saw with [https://www.samba.org/samba/security/CVE-2020-25717.html CVE-2020-25717], the default principal to username mapping in MIT Kerberos is unsafe if user creation on the realm is not privileged.

Even if (eg) sssd or Samba provides a more complex account to local name plugin, the default behaviour remains to to map a user in the default realm to the matching user locally.  It helps to avoid (eg) sssd mapping to an unprivileged account if that account is taken away before the ticket is presented. 

The [https://web.mit.edu/kerberos/krb5-1.20/doc/admin/host_config.html MIT Kerberos Host configuration documentation describes the defaults as:

 [realms]
    DEFAULT.REALM = {

 ...

        # Also allow principals from the default realm.  Omit this line
        # to only allow access to principals in OTHER.REALM.
        auth_to_local = DEFAULT
    }


==MIT-style servers don't know a $ is missing==

Unless the MIT-style kerberos acceptor enforces the presence of the PAC, and can read the PAC, using the [https://www.samba.org/samba/security/CVE-2020-25721.html extra information provided by Windows and Samba], it is not possible to know that the username has been stripped of the trailing $.  This allows more opportunity for attack as there is no need for permission to delete the account, and still operates after [https://support.microsoft.com/en-us/topic/kb5008102-active-directory-security-accounts-manager-hardening-changes-cve-2021-42278-5975b463-4c95-45e1-831a-d120004e258e Machine Accounts were restricted to keeping their trailing $]

==Impact==

A user able to create an account 'root$' in AD, via MachineAccountQuota, can present a ticket to the target as 'root' and access (eg) SSH as root in default domain-joined machines using SSSD and 'realm', plus many similar and simpler custom per-deployment configurations.

== Exploit steps==
=== Environment ===
* Windows 2022 (fully patched) AD DC
** with Certificate services for LDAPS support

* Fedora 36 client
** python3-impacket and krb5-workstation packages installed

* Fedora 36 target
** Root account enabled at install
** joined to the AD domain
** <pre>realm join -U administrator win22.example.com –computer-name=fedora</pre>

===Steps===

 kinit andrew
 
 addcomputer.py -debug -k -dc-host abartlet-dc-win-22.win22.example.com WIN22.EXAMPLE.COM/andrew -method LDAPS -computer-name root
 
 kinit root
 
 ssh -v -o PreferredAuthentications=gssapi-with-mic -l root fedora

= Other related issues =
There are many other security issues, some related, that come form the same tree, including:

* [https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4?gi=5613c787ced6 Certifried: Active Directory Domain Privilege Escalation (CVE-2022–26923)]
* [https://support.microsoft.com/en-us/topic/kb5008382-verification-of-uniqueness-for-user-principal-name-service-principal-name-and-the-service-principal-name-alias-cve-2021-42282-4651b175-290c-4e59-8fcb-e4e5cd0cdb29 Microsoft CVE-2021-42282 KB5008382—Verification of uniqueness for user principal name, service principal name, and the service principal name alias]
* [https://www.samba.org/samba/security/CVE-2020-25722.html Samba AD DC did not do suffienct access and conformance checking of data stored (SPN/UPN uniqueness)]

=Mitigations=

==MachineAccountQuota is evil (only on Windows AD, unimplemented on Samba)==

Control MachineAccountQuota by changing <pre>ms-DS-MachineAccountQuota</pre> to 0.  This attribute is in the base domain DN, eg <pre>dc=domain,dc=com</pre> or using Group Policies to assign the SeMachineAccountPrivilege to a more restricted set of users (not 'Authenticated Users').

==Block creation of sensitive users==

It would be prudent to pre-create disabled users in Active Directory
matching on all privileged names not held in Active Directory, eg

 samba-tool user add root -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password
 samba-tool user add ubuntu -H ldap://$SERVER -U$USERNAME%$PASSWORD --random-password
 ...

(repeat for eg all system users under 1000 in /etc/passwd or special to any other AD-connected services, eg perhaps "admin" for a web-app)

==SSSD 2.7 and later==

SSSD 2.7 and later has added a way to check PAC presence and validity of certain fields inside PAC structure. If all users in your deployment get PAC issued (standard for AD), enabling PAC checks should mitigate the issues. See '''sssd.conf(5)''' manual page for the option '''pac_check'''. SSSD AD provider defaults to '''check_upn, check_upn_dns_info_ex''', adding '''pac_present''' will force PAC.

For full PAC checks when Dollar Ticket Attack mitigations applied at AD side, use '''pac_check = pac_present, upn_dns_info_ex_present''' which will deny any tickets that do not have PAC structures and even if PAC exists, UPN-DNS-INFO structure content must be consistent with the rest of the PAC and the ticket.

==MIT Kerberos==

It is recommended to have only a single auth to local name translation plugin enabled. SSSD and winbindd both enable own translation plugins but don't disable the default one. Thus, disabling a default one in case SSSD or winbindd's plugins are in use can help to mitigate the problem if no other user mapping is expected. This can only be recommended for pure AD environment because it could break classic Kerberos setup that expects mapping Kerberos principals to non-REALM-based POSIX user names.

Disabling a default plugin can be done with the following snippet. On Fedora and RHEL systems the snippet can be added to '''/etc/krb5.conf.d/''' directory in its own configuration file (as a '''disable-localauth.conf''', for example):

  [plugins]
   localauth = {
      disable = an2ln
   }

==General OpenSSH configuration==

One simple change is to not allow '''root''' login at all for OpenSSH server:

  PermitRootLogin no

This would prevent any type of authentication as root for OpenSSH server. Users still would be able to perform '''sudo''', if configured, but they'd have to login as normal users first.