ADKERB-009: Tipos de cifrado de Kerberos
- Plataforma
- Active Directory
- Categoría
- AD Kerberos Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los tipos de cifrado de Kerberos determinan la fortaleza del cifrado de los tickets. DES y RC4 (ARCFOUR-HMAC-MD5) son criptográficamente débiles y deben deshabilitarse en favor de AES128 y AES256. RC4 en particular es objetivo de los ataques de Kerberoasting porque es mucho más rápido de romper que los tickets cifrados con AES. Imponer cifrado solo AES aumenta sustancialmente la dificultad de los ataques de credenciales sin conexión.
Por qué importa
Kerberoasting and AS-REP Roasting do not require local admin or even an authenticated session beyond a single low-privilege domain user (for SPN ticket requests) or no session at all (for AS-REP when DONT_REQ_PREAUTH is set). The cracking time gap between RC4 and AES is the entire game. RC4-HMAC service tickets are encrypted with the NTLM hash of the service account password, which is an unsalted MD4 derivative; hashcat mode 13100 cracks RC4 Kerberos tickets at 6 to 12 billion candidates per second on a single RTX 4090. AES256-CTS-HMAC-SHA1-96 (hashcat mode 19700) runs at roughly 400 to 800 thousand candidates per second on the same hardware, a 15,000x to 30,000x slowdown driven by the 4096-iteration PBKDF2 key derivation. A password that falls in 4 hours under RC4 takes roughly 7 years under AES256 with the same dictionary and rules. Beyond Kerberoasting, RC4 enables ticket forgery refinements (silver and golden tickets encrypted under RC4 remain forgeable when an attacker has only the NT hash rather than the AES256 key) and exposes the domain to downgrade attacks where the attacker influences etype negotiation. Microsoft hardened the KDC against unconstrained RC4 with KB5021131 (CVE-2022-37966 / CVE-2022-37967) in November 2022; environments that explicitly re-enabled RC4 to bypass that update or that have stale msDS-SupportedEncryptionTypes values on service accounts inherit the same exposure. The blast radius is every Kerberoastable service account, which in real estates often includes SQL service accounts, SCCM accounts, and unconstrained-delegation servers that pivot directly to Tier 0.
Ruta de ataque
Step 1: Reconnaissance. From any authenticated domain context the attacker enumerates accounts with SPNs and AS-REP-roastable flags. Rubeus.exe kerberoast /nowrap /outfile:hashes.txt for SPN accounts. Rubeus.exe asreproast /nopreauth /outfile:asrep.txt for accounts with DONT_REQ_PREAUTH (UserAccountControl bit 0x400000). Step 2: Etype selection. The attacker requests service tickets specifying etype RC4_HMAC (23) in the AS-REQ / TGS-REQ. Rubeus, Impacket GetUserSPNs.py, and Certipy all default to or support requesting RC4 explicitly: GetUserSPNs.py contoso.local/lowpriv:Password -request -outputfile spns.kirbi. If the target service account has msDS-SupportedEncryptionTypes set to 0 (or with RC4 allowed), the KDC returns the TGS encrypted under the RC4 key derived from the NT hash of the account password. If the attribute is set to AES-only the KDC returns AES and the offline attack slows by four orders of magnitude. Step 3: Offline cracking. The attacker formats the captured blob as a hashcat $krb5tgs$23$ or $krb5asrep$23$ string and runs hashcat -m 13100 hashes.txt rockyou.txt -r OneRuleToRuleThemAll.rule against the service ticket, or -m 18200 against the AS-REP. Modern GPU rigs (8x RTX 4090) clear 96-bit RC4 keyspace for any service account with a password under 12 characters and a moderate ruleset within hours. Step 4: Lateral movement. With the cleartext password the attacker authenticates as the service account, frequently a SQL or SCCM service identity with unconstrained delegation, replication rights, or local administrator on Tier 1 hosts. From there they pivot to a DC and run DCSync (T1003.006) or extract the krbtgt hash for Golden Ticket persistence. Step 5: Optional golden / silver ticket forging. With the krbtgt hash extracted, an attacker who wants to evade modern detections can forge tickets specifying etype 23 (RC4) because RC4 tickets remain accepted by KDCs that have not enforced AES via msDS-SupportedEncryptionTypes on krbtgt. Mimikatz kerberos::golden /user:Administrator /domain:contoso.local /sid:S-1-5-21-... /krbtgt:<hash> /rc4 forges an RC4 ticket; the AES equivalent requires the AES256 key, which Mimikatz can extract only from a DC that has already generated it after a password rotation post-functional-level-upgrade.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain naming context via LDAP and reads msDS-SupportedEncryptionTypes from (1) the domain root object DC=<domain>, (2) every user object with a servicePrincipalName, every gMSA (objectClass=msDS-GroupManagedServiceAccount), and every account flagged with DONT_REQ_PREAUTH, (3) every computer object, and (4) every trustedDomain object under CN=System,DC=<domain>. The attribute is a bitmask: 0x01 DES_CBC_CRC, 0x02 DES_CBC_MD5, 0x04 RC4_HMAC_MD5, 0x08 AES128_HMAC_SHA1, 0x10 AES256_HMAC_SHA1, 0x20 Future. Any account where (value -band 0x07) is non-zero is flagged. Accounts where the attribute is null or 0 inherit the DC default, so the check then reads HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\SupportedEncryptionTypes on each domain controller over remote registry or PowerShell remoting; a value below 0x18 (AES only) or that includes the RC4 / DES bits constitutes a domain-wide finding. The check also reads HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\DefaultDomainSupportedEncTypes (the post-KB5021131 KDC default override) and msDS-Behavior-Version on the domain root to confirm functional level is sufficient for AES key generation (DFL 4 / Server 2008 or later). For each Kerberoastable account, the check captures pwdLastSet and msDS-KeyVersionNumber so the operator can confirm whether an AES key has actually been generated (the password must be rotated after AES support is enabled before AES keys exist for that account).
Valor recomendado
AES256_HMAC_SHA1 y AES128_HMAC_SHA1 como únicos tipos de cifrado admitidos. DES y RC4 deshabilitados mediante directiva de grupo y nivel funcional del dominio.
Remediación
Configura mediante directiva de grupo: Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Directivas locales > Opciones de seguridad > 'Seguridad de red: configurar tipos de cifrado permitidos para Kerberos' = AES128_HMAC_SHA1, AES256_HMAC_SHA1, tipos de cifrado futuros. Audita las cuentas con msDS-SupportedEncryptionTypes para identificar las restringidas a RC4. Asegura que todas las cuentas de servicio tengan claves AES generadas rotando las contraseñas después de habilitar AES a nivel de dominio.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-12, SC-13
- ANSSI
- R37
- CIS AD Benchmark
- 7.4.1
- MITRE ATT&CK
- T1558