Everybody welcome to the first video in the Cobra's module.
Now in this video we're going to be talking at a high level on what curb growth is and what the what
the flow is.
Now we're gonna be breaking down the flow over the next few videos of the module just to get a more
deeper dive.
So what is Cobra's curveballs is used for authentication and it uses ticket something called tickets
to authenticate and identify users for a particular service of some kind.
Now this also uses symmetric crypto which we're going to go over in the next model module now.
Why should you care about Cerberus so Active Directory uses cobras by default.
Now this is important to know because that means most enterprise environments are going to have this
setup.
Now the reason for this is because we don't want local passwords stored on the on the physical machines.
We want them stored on the domain controller.
So what this allows us to do is to send a user sends the password when logging in to the Domain Controller
and then a few back and forth happen and we get a ticket and then we can use that ticket to access a
Web resource or another machine or whatever the case might be a common issue for this is to take advantage
of something called a golden ticket.
Now I'm gonna leave that to you guys for homework to kind of dig up a little bit more research on it.
There is golden ticket silver tickets pass the ticket there's quite a few other techniques that you
can use to take over curb connection now golden ticket is going gonna be your go to because it provides
you a ticket with domain administrator access so you have full access to the domain with this golden
ticket and as an attacker if you can temporarily gain domain admin credentials even for a small amount
of time you can generate a golden ticket of your own and then pass that along wherever you want to go
to gain access to any machine that's on the domain.
Now a common flow for this is a client sends a TGT or a ticket generating ticket or it's also known
as an authentication ticket.
Now they send this over to the domain controller then the KDE with the domain controller verifies their
credentials and sends back an encrypted TGT back to the client.
The client then stores this locally so it can be accessed for future parts of the process which instead
for it sends the local TGT that's been encrypted with the service name for the service that it wants
to access then the ticket granting server sends an encryption key back to the client and then the client
then uses that to access that specific service.
So we're gonna go don't worry about this too much we're gonna hit this in pretty good detail on exactly
how this works.
But this is the high level overview sends the ticket in authentication request it gets back an encrypted
ticket it stores it it sends that ticket with a service name that it wants to access the.
Katie.
Katie C which will go over in the next video we'll then check to make sure they can access at the service
and if they can that sends back the session key which is what we see here.
And then it it gets the session key it goes to the service and then it can access whatever service that
might be whether it's a web page or not.
So does it the quick flow in the next video we're going to be going over a curveballs realm which kind
of will spawn off a lot of other parts of this conversation.