Exploiting MS14-068 with PyKEK and Kali

Sun, 14 Dec 2014 00:00:00 +0000

Here’s a quick writeup of exploiting MS14-068 using PyKEK and Kali.

Kali Prepwork

Install and Configure Kerberos

Install kerberos:

apt-get install krb5-user krb5-config

Create relevant kerberos config changes in /etc/krb5.conf:

[libdefaults]
 default_realm = pwn3d.local
[realms]
 pwn3d.local = {
 kdc = dc1.pwn3d.local
 admin_server = dc1.pwn3d.local
 default_domain = pwn3d.local
}

Point DNS to the DNS Server/domain controller so SRV records (e.g. _kerberos._tcp.*) will resolve correctly in /etc/resolv.conf.

According to the TrustedSec blog, you’ll need to sync time with the domain controller. During my testing I didn’t perform any syncing and had no issues.

Kali on Zach Grace

Exploiting MS14-068 with PyKEK and Kali

Kali Prepwork

Install and Configure Kerberos