The krbtgt password, backup and recovery
You measure the age and key version of the password of the domain’s most critical account, krbtgt, learn the Golden Ticket risk and the "change it twice" rule, audit the tombstone lifetime and the Recycle Bin, find the object deleted by accident this morning among the deleted objects and write a recovery plan. The deleted object differs in every lab.
Level 201 · 45 min
krbtgt is the account that signs every Kerberos ticket in the domain. Nobody logs on with it (it is disabled), but its password hash is the key to all trust. An attacker who steals this hash can make valid tickets for any user, for any length of time: this is called a Golden Ticket. The only way out is to change the krbtgt password twice (because DCs also accept the previous password), waiting for replication to complete between the two changes.
Analogy: krbtgt is like a company’s official stamp. Someone who copies the stamp can make any document "official". Until the stamp changes, the forged documents stay valid.
The second half of this lesson is about recovery: this morning the help desk deleted an object by accident. AD keeps deleted objects for a while (the tombstone lifetime) in the CN=Deleted Objects container; the audit account has been allowed to read it.
What you will do in this lesson
- Look at the krbtgt account
- How old is the password?
- The tombstone lifetime
- Is the Recycle Bin enabled?
- Deleted objects
- What was deleted, and from where?
- The krbtgt finding
- The recovery plan
- Short quiz
Skills you will earn
- Auditing the age and key version of the krbtgt password
- Converting Windows FILETIME values to dates
- Tombstone lifetime, backup life and the Recycle Bin
- Finding deleted objects (the show deleted control)
- Writing audit findings into a report
← SMB and LDAP signing, LDAPS · Active Directory security: auditing and hardening · Capstone: the CORP.LAB audit report →
Start for free