Rapid7 has released Metasploit Framework 6.3, which adds native support for Kerberos authentication, incorporates new modules to conduct a wide range of Active Directory attacks, and simplifies complex workflows to support faster and more intuitive security testing.
Kerberos is anย authentication protocolย commonly used to verify the identity of a user or a host in Windows environments. Kerberos support is built into most operating systems, but itโs best known as the authentication protocol used in Active Directory implementations, which thousands of organisations rely on to define user groups and permissions and to provision network resources.
Kerberos and Active Directory more broadly have been primeย attack targetsย and featured prominently in both threat actor and pen tester playbooks.
In 2021, a slew of novel attack techniques were published for targetingย Active Directory Certificate Servicesย (AD CS) โ a popular tool that allows administrators to implement public key infrastructure, and to issue and manage public key certificates. Abusing AD CS gave adversaries and red teams fresh opportunities to escalate privileges, move laterally, and establish persistence within Windows environments.
Today, first-class support for Active Directory and Kerberos-based attack techniques is critical to many pen testers and security researchers keen to demonstrate risk to clients and the public. Whilst plenty of new tooling has sprung up to facilitate offensive security operations, much of that tooling requires operators to manage their own tickets and environment variables, and/or is too narrowly scoped to support end-to-end attack workflows. As a result, many operators find themselves using multiple purpose-built tools to accomplish specific pieces of their playbooks, and then having to track ticket information manually to pursue broader objectives.
Metasploit Framework 6.3 streamlines Kerberos and Active Directory attack workflows by allowing users to authenticate to multiple services via Kerberos and build attack chains with new modules that request, forge, and convert tickets between formats for use in other tools. Tickets are cached and stored in the Metasploit database as loot, which removes the need for manual management of environment variables. Attack workflows support pivoting over sessions out of the box, as users expect from Metasploit.
Key highlights include:
- Native Kerberos authentication over HTTP, LDAP, MSSQL, SMB, and WinRM
- The ability to request Ticket-Granting Tickets (TGT) and Ticket-Granting Server (TGS) if the user obtains a password, NT hash, or encryption key; users can also request tickets via PKINIT with certificates issued from AD CS
- Kerberos ticket inspection and debugging via theย auxiliary/admin/kerberos/inspect_ticketย module andย theย auxiliary/admin/kerberos/keytabย module, which can generate Keytab files to allow decryption of Kerberos network traffic in Wireshark
- Fully automated privilege escalation via Certifried (CVE-2022โ26923)
You can find a more detailed overview of Metasploit Framework 6.3ย here.
About Rapid7
Rapid7, Inc. (Nasdaq: RPD) is on a mission to create a safer digital world by making cybersecurity simpler and more accessible. We empower security professionals to manage a modern attack surface through our best-in-class technology, leading-edge research, and broad, strategic expertise. Rapid7โs comprehensive security solutions help more than 10,000 global customers unite cloud risk management and threat detection to reduce attack surfaces and eliminate threats with speed and precision. For more information, visit ourย website,ย check out ourย blog, or follow us onย LinkedInย orย Twitter.
