News for hackers. Stuff that matters.

A comment on Lessons from a Professional Password Cracker. Parent comment

Re:Lessons from a Professional Password Cracker by yabones on Monday September 26, 2022 @10:34AM (#32983641)
Windows (in a domain environment) sends a Kerberos token for network auth which is generated on sign on and signed by a domain controller (authentication server). When the user authenticates to a network service, the token is sent to the service to validate without the need for an additional network hop to the domain controller.

Each "console" is a "seat" sort of like a PTY emulating a serial connector. Whether you're hands on keyboard or using a remote desktop connection, your login session has one kerberos ticket which is used for authentication automatically.

https://en.wikipedia.org/wiki/Kerberos_(protocol)

[ Parent | on HN ]
Re:Lessons from a Professional Password Cracker by mr_mitm on Monday September 26, 2022 @10:50AM (#32983870)
Yes, I know how Kerberos works. The TGT is not bound to anything though, it can be stolen and reused elsewhere. And in the default setting, an attacker doesn't need to rely on Kerberos as an authentication mechanism, since NTLMv2 support is widely available. It's available by default.

Nevertheless, did GP mean Kerberos tickets by "domain credentials"? How does Kerberos prevent the use of password managers? I'm confused.

[ Parent | on HN ]