Hello, guys, and welcome to the last video
on this chapter in this video, we are going to learn how
we can use Wireshark to find user account names and hosts and Kerberos traffic for
Windows in an active directory environment.
Let's talk about Kerberos and how does it work and what is
used for and before we start exploring the Kerberos traffic with Wireshark
Kerberos is a computer network security protocol that authenticates service
requests between two or more trusted hosts across
a network, usually an untrusted network like the Internet.
It uses a secret key cryptography and
trusted third party for authenticating client server
applications and verifying users identities.
Initially, it was developed by the MIT
Massachusetts Institute of Technology for the project Athena in the late 80s.
So now, as you already know, Kerberos is
the default authorization technology used by Microsoft Windows.
The protocol derives its name from the legendary three headed dog Kerberos
from the Greek myth The Guardian to the entrance of the underworld.
But in the protocol says that, the three heads of Kerberos, represent the
client, the Server, and the key distribution center.
Kerberos is found everywhere in the digital world.
It is employed heavily on SQL systems that
depend on reliable auditing and Authentication features.
It is also used in Botox, Authentication, active Directory in the first sambal.
It is also not Authentication system to assess bob nsm.
and smtp.
So for the purpose of this video, we are going to use previously captured
traffic from the Windows first and the active Directory environment.
As you can see, is the Domain has became the dog.
We have the Domain controller IP.
The segment Gateway,
the host name of the Domain controller and the Windows client, IP.
But let's jump right into the pcap file with Wireshark who have loaded up
host and user id pcap in my Wireshark here.
And we are going to explore a few things and see how we can find out
user account names and host names and so on and so forth.
So once we have open the pcap in Wireshark,
we can go straight away to the display filter and apply the.
By by typing Kerberos dot
as you can see, there is a drop down menu
coming with all the options available for your display filter here.
What we are going to use for this lesson auto start is the Kerberos.CnameString.
Just go ahead and select this one, hit enter
and you can use you can select any
line that's just go ahead and choose the first highlight the first line and go to.
And right, click on that.
After you apply this filter, you can go ahead and highlight
any line from the results appeared in front of you.
This is go ahead and select the first frame.
We can go to the frame details section and expand the lines.
So as you can see in these lines, we also have the Kerberos line added to the normal
mission control line, they did not protocol version and so on and so forth.
So if you just go ahead and click on
Kerberos line, you can find pretty much a lot of information that can be useful.
So if you just expand krb-as-req.
You can see the message type,
just go ahead and expand pa data, and there ate
many subsections and that you can click on req body and see all the information.
So after you clicked on this
req-body, you can find the information that we saw in the slide e
arlier, so the realm, which is happycraft.org is the Domain name.
You can go a little bit further down and you have the addresses he typed.
You can also expand this one and see if you can get something.
So the addresses you can find to your host address is Johnson-PC.
So there you go.
We have the hostname, the Windows host name of the.
Person that is trying to authenticate them all is already authenticated.
In the active Directory, so we have the Windows host name.
Now, if you go ahead and highlight this,
Host address Johnson-pc and right, click on that.
And apply that as a column.
If we scroll up a little bit and
after we check every single line of information here, we can go and expand in
the cname and in the cname Stream, you can also find this
Johnson-pc, as you can see, so the reason I went there
is that we are going to use this thing name string,
to apply it as a column like we are going to do now as we are going to do now.
Right, click on cname string apply as column.
You can see the.
The Windows host name has been applied in our search results.
That's a column, so if you go and scroll down, you can see that.
You can find a user account name theresa.
Johnson.
But this is normally, as you can see, found.
In the traffic between the Domain controller.
Which is the eight dot eight
and the Windows client, in this case, a DOT 201 that you can see here.
Those cname string bios for host names always end with the dollar sign, as you
can see here, JOHNSON-PC$ and a dollar sign.
And the user accounts, as you can see in this case theresa.
Johnson $ do not do have.
If you would like to filter on only the user account named.
And eliminate cname string results.
With a dollar sign, you can go ahead and use the same cnamestring here,
Kerberos.cnamestring String, and you can go ahead space.
And space | mark.
Then you open parenthesis,
you write Kerberos dot in mainstream, you can go ahead and.
Like these from the drop down menu space
contains space dollar sign.
Then you close parenthesis.
You can apply this filter.
And you can see now that the results.
That we have in front of us have only the user account names.
Well, as you can see, proper
identification of hosts and users from network traffic is essential when
you're reporting malicious activity in your network
using the methods that we just demonstrated in this video tutorial.
We can better utilise Wireshark to help us identify effective hosts and users.
That was the last video for this chapter.
And when you're ready, you can go ahead
and click on the first video of Chapter four.
Where you are going to learn how to capture traffic from a particular host