gssapi-abuse: A tool for enumerating potential hosts
gssapi-abuse was released as part of my DEF CON 31 talk. A full write-up on the abuse vector can be found here: A Broken Marriage: Abusing Mixed Vendor Kerberos Stacks
The tool has two features. The first is the ability to enumerate non-Windows hosts that are joined to Active Directory that offer GSSAPI authentication over SSH.
The second feature is the ability to perform dynamic DNS updates for GSSAPI abusable hosts that do not have the correct forward and/or reverse lookup DNS entries. GSSAPI-based authentication is strict when it comes to matching service principals, therefore DNS entries should match the service principal name both by hostname and IP address.
The enumeration mode will connect to Active Directory and perform an LDAP search for all computers that do not have the word
Windows within the Operating System attribute.
Once the list of non Windows machines has been obtained, gssapi-abuse will then attempt to connect to each host over SSH and determine if GSSAPI based authentication is permitted.
DNS mode utilises Kerberos and dnspython to perform an authenticated DNS update over port 53 using the DNS-TSIG protocol. Currently
dns mode relies on a working krb5 configuration with a valid TGT or DNS service ticket targetting a specific domain controller, e.g.
Adding a DNS
A record for host
Adding a reverse
PTR record for host
ahost.ad.ginge.com. Notice that the
data argument is terminated with a
., this is important or the record becomes a relative record to the zone, which we do not want. We also need to specify the target zone to update, since
PTR records are stored in different zones to
Forward and reverse DNS lookup results after execution