Elevating Kerberos to the Next Level

## Overview

In this Black Hat presentation, James Forshaw (Google Project Zero) and Nick Landers (NetSPI Adversarial R&D) explore Kerberos authentication on Windows. While Kerberos is traditionally evaluated in the context of remote client-to-server network authentication and remote attacks, the speakers focus specifically on leveraging Kerberos mechanisms locally for privilege escalation on a domain-joined Windows machine.

---

## Standard Local Kerberos Authentication Flow

Kerberos on Windows is not restricted to authenticating across network boundaries; a user can authenticate to services hosted on the very same machine:

1. **Initial Authentication & TGT**: Upon logging into a domain-joined Windows machine with a user password, the client requests a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC). Inside the TGT resides the Privileged Attribute Certificate (PAC), which specifies the user's identity and group memberships. 2. **SSPI & LSA Architecture**: Instead of interacting directly with the KDC over raw TCP sockets, Windows applications use the Security Support Provider Interface (SSPI) to communicate with the Local Security Authority (`lsass.exe` / LSA). The authentication requests are handled by the Kerberos DLL executing inside the LSA process. 3. **Ticket Granting Service (TGS) Request**: An application invokes `InitializeSecurityContext`, supplying a Service Principal Name (SPN) for the target local service (such as `host/ABC`). Kerberos packages this into a TGS request and sends it to the KDC. 4. **Service Ticket Encryption & Validation**: The KDC looks up the long-term key corresponding to the target SPN, which is derived from the computer account password of the local system. The KDC copies the PAC from the TGT into the service ticket and encrypts it using this machine key. 5. **Context Acceptance & Impersonation**: The service receives the ticket via an AP-REQ (Kerberos Application Request) packet and calls `AcceptSecurityContext`. LSA uses the known local computer key to decrypt the service ticket, extracts the PAC, generates a Windows access token, and impersonates the caller.

Under normal execution, this flow does not yield elevated privileges because the PAC remains restricted to the group memberships originally issued to the user by the KDC.

---

## Local Silver Ticket Technique for Privilege Escalation

The speakers adapt the well-known remote "Silver Ticket" attack to achieve local privilege escalation:

* **Key Derivation**: While an unprivileged attacker does not possess the computer account's long-term key, they do have full access to their own user password, from which their user Kerberos key can be derived locally. * **Forging Service Tickets**: By generating this key inside their own process without interacting with the KDC, an attacker can craft a completely forged service ticket containing an arbitrary, modified PAC. * **PAC Manipulation**: The attacker specifies arbitrary elevated group memberships—such as local administrator privileges—directly inside the forged PAC. * **Token Impersonation via SSPI**: The forged ticket is passed directly into `AcceptSecurityContext`. When LSA accepts the security context, it constructs an access token reflecting the elevated privileges injected into the PAC, allowing the process to impersonate an administrator on the local system.

---

## Tooling and Implementation

* **Target Platform**: Demonstrated against a Windows 10 host. * **Implementation**: The tooling was implemented using custom .NET code, with PowerShell used as the interface to execute the attack primitives and drive the SSPI authentication APIs.