VB what you offers is pure quality ... whenever I find it difficult to understand something that is quite technical about kerberos I return to your videos. you are amazing
thanks, always nice to hear :) not sure if I'll be making more content any time soon as this was only ever a hobby for me. Might do a video explaining that though lol
Really helped understand the request flow diagram in Kerberos authentication. You have explained the complex looking concepts in a very simplified manner. Kudos! Keep up the great work!
Your three-tiered approach proved to be very effective in helping me grasp the info. First time viewing one of your videos. I'm subscribed and think I'll be spending significant time in your presentations. Thanks.
Dude thank you so much. I spent hours trying to understand this process. I felt like I had almost all the parts except a couple steps weren't clicking for me. You made those click. Cheers!
@VbScrub - this is the single BEST in-depth explanation and deep dive into Kerberos I've ever seen, and I've read (and watched) **all of them**. I've read the MIT documentation, the Windows & Microsoft documentation, many other Blogs and Guides and videos, and you have single-handedly outclassed them all. Kerberos is an incredibly complex and confusing topic (largely due to the authors of the protocol) that you have broken down and explained step by step of the 5 W's (Where, When, Why, hoW and Who) of modern Kerberos. Thank you so much! Subscribed!
Damn, the Wireshark part was really helpful. I wish I could give more than a like because of the effort you put into this, specifically talking about the script you made for demo purposes. Subbed!
I have yet to see a better explanation than this! (Although I am not searching for it because there cannot be a better explanation than this). Great Work. God bless you
So many years using Windows systems, and never needed to know much of anything about Kerberos other than making sure your time is set correctly... Until the Nov 2022 updates when MS broke it all lol. Really shows how robust this whole system is that it has rarely been an issue before when it is tied to literally everything windows.
This method of explanation is brilliant, starting simple so you get a chance to understand the principals first then expand on that. All the other videos I've seen just dive in the deep end and it's too confusing.
Fantastic video. I watched another intro video a few weeks, but that video did not even come close to this level of detail. Your experience in this field shows and I hope you continue to make content. Thank you :)
Recently discovered and subbed. Came here only knowing what Kerberos is used and good for, saw the whole video and now I can say I've learned a lot. You are producing some high quality content, thank you very much! I'm glad I discovered your channel and looking forward to new videos!
very nice - please make more videos for windows, ad, windows security - there is enough for linux outside - but for windows it is hard to find good quality stuff with good explanation.
Thanks a lot for all of your content. Can you do a video where you explain windows users management and cover the difference between local administrator, domain admin, NT AUTHORITY ... and who is most powerfull account Thanks again
Thank you particularly the packet capture at the end! Can you explain the use of the ( kvno ); I see it is 2 for the as-rep ticket enc-part and 4 for as-rep enc-part then later on is 6 for the tgs-rep ticket enc-part?
Nice video, i didnt get the info on where to run the wireshark (on which host), i.e client level, KDC Level, SQL Server level..... currently i am getiing issue with SAP application with SPNego steup, in the appliction log it writes err NTLM token received which is not accepted....instead the browser should send the SPNego tkt to the application service.
I don't know that much about SQL server security to be honest (other than the kerberos based attacks mentioned in this video) but AD domain/forest trust related attacks are definitely something that I'll do a video on in the future
@@vbscrub cool. Keep it up mate. Just finished your cascade machine few days back. Definitely not medium level lol it was hard. Looking forward to your new boxes too.
Just need a clarification: during TGS-REP Session Key should be encrypted with TGS session key and not the user's password (NTLM hash)? User can use the previously cached TGS session key received during AS-REP to decrypt it?
In 30:22 , TGS-REP part. Isn't the session key sent by TGS suppose to be encrypted with the session key that was previously decrypted with the user password (AS-REP)? Instead of encrypting it with user password agn.
One Quick Question Step 6: SQL server also read session key so does that mean SQL server has User J smith account password or NTLM has of J smit account's password
Wouldnt public key pair make more sense? ie krbtgt holds apl the public keys but the private ones are only local More complex but cant see how to create large attacks
I can upload it somewhere if you want but you saw how short the code was. Would be easy to recreate it yourself in the free version of visual studio. It would need changing anyway cos it has hard coded credentials in
@@vbscrub Thanks a lot for your quick response! Im not really sure if formulated my question correctly, its just that i was watching your video about the kerberos golden ticket some time ago, and i couldn't completely understand the attack. I understood that if you had the krbtgt account ntlm hash then you could fake the tgt ticket, but i didn't understand how it was possible to also fake the session key. In this video, the tgs-req contains the tgt(i understood why we were able to fake it) and it also contains some data encrypted with the session key from as-rep. Before encrypting the data for the tgs-req, the session key gets encrypted with user's password and then the final result after the encryption is used to encrypt the data that will be sent in tgs-req. So how is this attack even possible if the attacker doesn't know the user's password to initially encrypted the session key before using it to encrypt the data for the tgs-req? Really long comment srry, but i hope you understand. Thanks a lot again for your quick response! :)
The only reason you need the user's password is to decrypt the session key to prove that you know the session key contained in the TGT (because the same session key is used in the TGT but encrypted with krbtgt account password). But in a golden ticket attack we already know the session key in the TGT because we're faking the whole TGT so we can just set it to whatever we want and then encrypt the whole thing with krbtgt account password. So after that the process carries on as normal - we use the TGT to request a TGS, and as part of that request we have to prove we know the session key in the TGT by encrypting some data using the session key as the key for that encryption.
@@spotifyfan8084 This is the part you've got wrong: "Before encrypting the data for the tgs-req, the session key gets encrypted with user's password and then the final result after the encryption is used to encrypt the data that will be sent in tgs-req". The TGS-REQ doesn't include the session key encrypted with the user's password. It just includes data that is encrypted with the session key. The user's password only came into it so that the user could read the session key. So if you already know the session key (which is easy when you're able to forge the entire ticket because you have the krbtgt account password) then you can complete that step just fine without knowing the user's password
Ohhhhhh now i understand, guess i just got confused with the diagram, anyways thanks a lot @VbScrub for clearing the problem in my head :) I really appreciate your work mate, keep going, really instructive videos!
![กี่หมื่นฟ้า | Your Sky Series EP.1 [2/4]](http://i.ytimg.com/vi/qJbQs_nhjD4/mqdefault.jpg)
I can't believe am getting this quality content for free from youtube
After a ton of incomprehensible tutorials, this made it click. Thanks!
great to hear :) thanks
VB what you offers is pure quality ... whenever I find it difficult to understand something that is quite technical about kerberos I return to your videos. you are amazing
You explained the topics very clearly not only for this video but to all of your videos. I hope you come back and create more videos again, thank you!
thanks, always nice to hear :) not sure if I'll be making more content any time soon as this was only ever a hobby for me. Might do a video explaining that though lol
Really helped understand the request flow diagram in Kerberos authentication. You have explained the complex looking concepts in a very simplified manner. Kudos! Keep up the great work!
Thank you for the Clear Explanation 🙏🙏, one of the best video on Kerberos authentication and practical demonstration through pcap
Your three-tiered approach proved to be very effective in helping me grasp the info. First time viewing one of your videos. I'm subscribed and think I'll be spending significant time in your presentations. Thanks.
Glad to hear that, thanks :)
Absolutely FANTASTIC Kerberos explanation, diagrams, AND demo! Kudos to you! I've already watched it twice. MM
cheers, glad to hear it helped!
Dude thank you so much. I spent hours trying to understand this process. I felt like I had almost all the parts except a couple steps weren't clicking for me. You made those click. Cheers!
@VbScrub - this is the single BEST in-depth explanation and deep dive into Kerberos I've ever seen, and I've read (and watched) **all of them**. I've read the MIT documentation, the Windows & Microsoft documentation, many other Blogs and Guides and videos, and you have single-handedly outclassed them all.
Kerberos is an incredibly complex and confusing topic (largely due to the authors of the protocol) that you have broken down and explained step by step of the 5 W's (Where, When, Why, hoW and Who) of modern Kerberos. Thank you so much! Subscribed!
thanks for the kind words!
Damn, the Wireshark part was really helpful. I wish I could give more than a like because of the effort you put into this, specifically talking about the script you made for demo purposes. Subbed!
I have yet to see a better explanation than this! (Although I am not searching for it because there cannot be a better explanation than this). Great Work. God bless you
best video on kerberos stuff that ive found - THX
Finally a video that has a pcap example along with it. Nicely done mate.
So many years using Windows systems, and never needed to know much of anything about Kerberos other than making sure your time is set correctly... Until the Nov 2022 updates when MS broke it all lol. Really shows how robust this whole system is that it has rarely been an issue before when it is tied to literally everything windows.
the best Kerberos explanation on the web
THANK YOU!
this is BY FAR the best explanation ive found. it is so good that im writing my first comment ever on YT bc it helped me a lot!
Glad it helped!
This method of explanation is brilliant, starting simple so you get a chance to understand the principals first then expand on that. All the other videos I've seen just dive in the deep end and it's too confusing.
I like the way you're teaching... Thanks...
Fantastic video. I watched another intro video a few weeks, but that video did not even come close to this level of detail. Your experience in this field shows and I hope you continue to make content. Thank you :)
thanks, much appreciated!
Indeed same for me ! Well explained.
Thank you for the great, in depth explanation!! I've been struggling with this on the Security + practice exam. Going to get this nailed down today.
This was the best explanation I found by far. Thank you.
Recently discovered and subbed. Came here only knowing what Kerberos is used and good for, saw the whole video and now I can say I've learned a lot. You are producing some high quality content, thank you very much! I'm glad I discovered your channel and looking forward to new videos!
Thanks, glad you learned something from it :)
Best explanation on TH-cam. Thank you!
Your explanations are phenomenal. Thank you
Wow! This made such a difference in my understanding of Kerberos. Thank you so much for all your effort.
Best AD content on youtube, thank you
amazing work, i couldnt fully understand this topic until i came across this !! wow !!
This is so helpful. Love the way you explained it in layers. Thank you so much.
no problem. Glad it helped!
This is really helpful and made so many concepts clearer to me. Thank you so much!
Really Awesome the way you have explained ! Thank you very much for your time and really appreciated !!
26:30 AS-REQ is encrypted with the user's password not krbtgt's.. right?
Superb explanation, thanks 🙏
Best explanation ever!
Thank your for your work, that was amazing!
These videos are invaluable. Thank you so much for making them.
Nice video and a good explanation, very useful for hackthebox and understanding what the remote machine is doing, keep up the good work dude!
Thanks :)
Wow that was such an awesome explanation. Thank you so much for putting efforts to create this video, sir! It really helped me a lot.
thanks, glad to hear that :)
Awesome, clear, concise and to the point thanks for sharing.
thanks :)
Thank you so much for great explanation
very nice - please make more videos for windows, ad, windows security - there is enough for linux outside - but for windows it is hard to find good quality stuff with good explanation.
Thanks. I'll do my best :)
The session key of the TGS is encrypted with the service account password ??
Thanks a lot for all of your content. Can you do a video where you explain windows users management and cover the difference between local administrator, domain admin, NT AUTHORITY ... and who is most powerfull account
Thanks again
Excellent Thank you for your time
Hidden gem 💎
excellent vid. thanks
Great work dude, I had alot of problems with windows htb machine and this underlying knowledge is gonna help me alot. 0 dislikes for a reason :)
Great video! Thank you so much for sharing.
Good explaination. Can you please provide the example .Net-code so we could experiment? Thank you in advance.
Thank you particularly the packet capture at the end! Can you explain the use of the ( kvno ); I see it is 2 for the as-rep ticket enc-part and 4 for as-rep enc-part then later on is 6 for the tgs-rep ticket enc-part?
Nice video, i didnt get the info on where to run the wireshark (on which host), i.e client level, KDC Level, SQL Server level..... currently i am getiing issue with SAP application with SPNego steup, in the appliction log it writes err NTLM token received which is not accepted....instead the browser should send the SPNego tkt to the application service.
This video made me sub. Great material - thanks!
just stumbled across your channel. thanks a stack mate
Thank you for the great✌
This is gold
Thanks for your videos! I appreciate it very much man. Learnt a lot from them!
Thankyou very much sir.
Awesome video mate ! Have you ever thought about making attacks based on AD Trusts or MSSQL Server attacks. Again thanks for the video
I don't know that much about SQL server security to be honest (other than the kerberos based attacks mentioned in this video) but AD domain/forest trust related attacks are definitely something that I'll do a video on in the future
@@vbscrub cool. Keep it up mate. Just finished your cascade machine few days back. Definitely not medium level lol it was hard. Looking forward to your new boxes too.
Just need a clarification: during TGS-REP Session Key should be encrypted with TGS session key and not the user's password (NTLM hash)? User can use the previously cached TGS session key received during AS-REP to decrypt it?
Really well explained, thanks for your efforts.
In 30:22 , TGS-REP part. Isn't the session key sent by TGS suppose to be encrypted with the session key that was previously decrypted with the user password (AS-REP)? Instead of encrypting it with user password agn.
One Quick Question Step 6: SQL server also read session key so does that mean SQL server has User J smith account password or NTLM has of J smit account's password
Wouldnt public key pair make more sense? ie krbtgt holds apl the public keys but the private ones are only local
More complex but cant see how to create large attacks
THAT was really good!
Great video. Can you share the code you used in the demo?
Good job! Thank you for the detail explain
no problem :)
Dude where’s that code? I didn’t see you post it? Or where did you get it from?
33:25 on your video! Can you send me it?
Thank you for this great video...
Wow! well done!
Pretty good video, but there's one mistake: the new session key encrypted with previous session key, not with user's password
Very nice video, may I know what is the exact data encrypted using the session key in tgs-req and ap-req? Thanks
that's in-depth Kerberos
awesome 👍 good explanation
Thank you so much for the video! Very well explained subscribed!! :>
wooow , finally some easy explaintation of Kerberos , plz keep it up
but i'm wondering if i can get the kerbDemo.exe ?
I can upload it somewhere if you want but you saw how short the code was. Would be easy to recreate it yourself in the free version of visual studio. It would need changing anyway cos it has hard coded credentials in
@@vbscrub got it
thank you so much and just keep it up
Great video! Keep up the good work
Very nice!
Wow those videos are amazing thanks
Awesome video!
This is really great , Thanks a lot
Damn, such a good video. Thanks!
Are you sure that the session keys in step 2 and 4 are encrypted with user's password? and not with the krbtgt account?
The session key is encrypted with both, in separate places. Watch the full video and its explained
@@vbscrub Thanks a lot for your quick response! Im not really sure if formulated my question correctly, its just that i was watching your video about the kerberos golden ticket some time ago, and i couldn't completely understand the attack. I understood that if you had the krbtgt account ntlm hash then you could fake the tgt ticket, but i didn't understand how it was possible to also fake the session key. In this video, the tgs-req contains the tgt(i understood why we were able to fake it) and it also contains some data encrypted with the session key from as-rep. Before encrypting the data for the tgs-req, the session key gets encrypted with user's password and then the final result after the encryption is used to encrypt the data that will be sent in tgs-req. So how is this attack even possible if the attacker doesn't know the user's password to initially encrypted the session key before using it to encrypt the data for the tgs-req? Really long comment srry, but i hope you understand. Thanks a lot again for your quick response! :)
The only reason you need the user's password is to decrypt the session key to prove that you know the session key contained in the TGT (because the same session key is used in the TGT but encrypted with krbtgt account password). But in a golden ticket attack we already know the session key in the TGT because we're faking the whole TGT so we can just set it to whatever we want and then encrypt the whole thing with krbtgt account password. So after that the process carries on as normal - we use the TGT to request a TGS, and as part of that request we have to prove we know the session key in the TGT by encrypting some data using the session key as the key for that encryption.
@@spotifyfan8084
This is the part you've got wrong:
"Before encrypting the data for the tgs-req, the session key gets encrypted with user's password and then the final result after the encryption is used to encrypt the data that will be sent in tgs-req".
The TGS-REQ doesn't include the session key encrypted with the user's password. It just includes data that is encrypted with the session key. The user's password only came into it so that the user could read the session key. So if you already know the session key (which is easy when you're able to forge the entire ticket because you have the krbtgt account password) then you can complete that step just fine without knowing the user's password
Ohhhhhh now i understand, guess i just got confused with the diagram, anyways thanks a lot @VbScrub for clearing the problem in my head :) I really appreciate your work mate, keep going, really instructive videos!
Legend
Nice!
I would love to see this animated as envelopes that fit inside each other and need a key (attached to each host/service) to open.
Why so hurry man..you can explain slowly...
Speak slowly Sir