Attacking FreeIPA, the open-source Active-Directory alternative for Unix environments, during authorized red-team operations - covering anonymous and authenticated LDAP/ipa enumeration, Kerberos CCACHE/keytab credential theft and reuse, HBAC and sudo rule abuse, hash extraction and cracking, IPAHound graphing, and PKINIT/S4U2proxy host-account takeover.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Attacking FreeIPA, the open-source Active-Directory alternative for Unix environments, during authorized red-team operations - covering anonymous and authenticated LDAP/ipa enumeration, Kerberos CCACHE/keytab credential theft and reuse, HBAC and sudo rule abuse, hash extraction and cracking, IPAHound graphing, and PKINIT/S4U2proxy host-account takeover.
domain
cybersecurity
subdomain
red-teaming
tags
["red-teaming","freeipa","kerberos"]
version
1.0
author
xalgorix
license
Apache-2.0
Pentesting FreeIPA
When to Use
You find Unix/Linux hosts integrated with a central identity provider, a FreeIPA web UI on 443, or /etc/krb5.conf and /etc/ipa/default.conf on a foothold.
LDAP (389/636) and Kerberos (88) services answer on a server and clients have sssd configured.
You compromised a domain-joined Unix host and want to enumerate users/hosts/groups, harvest Kerberos tickets, and abuse HBAC/sudo rules for lateral movement.
You hold a standard user, a host keytab, or a service account and need a graph-driven path to domain compromise.
Critical: Techniques Most Often Missed
Anonymous LDAP bind — by default FreeIPA's LDAP allows anonymous binds, exposing a large amount of data unauthenticated.
ldapsearch -x # anonymous bind, dumps enumerable data unauthenticated
How to CONFIRM: ldapsearch -x -b "dc=domain,dc=local" returns user/host entries without credentials.
Stealing and reusing CCACHE tickets from /tmp — CCACHE files live in /tmp with 600 perms and let you authenticate without the plaintext password.
klist # parse the current ticketexport KRB5CCNAME=/tmp/krb5cc_1000 # reuse a stolen ccache
klist # confirm the imported TGT
How to CONFIRM: after exporting KRB5CCNAME, klist shows a valid krbtgt/... ticket and ipa user-find works without kinit.
Keytab reuse for non-interactive TGTs — /etc/krb5.keytab (hosts) and service keytabs yield TGTs without any password via kinit -k.
kinit -k -t /etc/krb5.keytab 'host/srv.domain.local@DOMAIN.LOCAL'
klist -k /etc/krb5.keytab # enumerate principals/keys in a keytab
How to CONFIRM: succeeds and shows the host/service TGT; reuse it against LDAP with .
kinit -kt
klist
ldapwhoami
admin == Domain Admin; root on the IPA server owns the hashes — the FreeIPA admin role equals AD domain admins, and root on the server can dump hashes with dbscan (userPassword/ipaNTHash base64 attributes).
How to CONFIRM: ipa user-show admin --all and, on the server as root, dbscan extraction of userPassword/ipaNTHash.
HBAC + sudo rule chaining to a DC — CanSSH (HBAC allows sshd) plus CanSUDO (HBAC + matching sudo rule, especially ipaSudoOpt=!authenticate) to a domain controller can let you steal id2entry.db = effectively full domain compromise.
How to CONFIRM: ipa hbacrule-show <rule> --all and ipa sudorule-show <rule> --all reveal a path; test ssh then sudo -l on the target host.
BloodHound-style FreeIPA attack graphing and path discovery.
LinikatzV2 / linikatz
Harvest Kerberos/secret material from Unix hosts.
ipa-getkeytab / ldapmodify
Reset service keys; write certs for PKINIT takeover.
Common Scenarios
Scenario 1: Anonymous LDAP exposes the directory
ldapsearch -x against the FreeIPA server returns users, groups, and hosts without credentials, giving a full target list and revealing service accounts to spray.
Scenario 2: Host keytab to lateral movement
A compromised client's /etc/krb5.keytab is reused with kinit -k -t /etc/krb5.keytab host/srv@DOMAIN.LOCAL. Authenticated ldapsearch -Y gssapi and ipa hbacrule-find map a CanSSH+CanSUDO path to a domain controller; SSHing and sudo there allows copying id2entry.db.
Scenario 3: Service account PKINIT takeover
Holding a computer account that owns its service principals, the operator issues a cert with ipa cert-request, writes userCertificate;binary to the service object via ldapmodify, and runs kinit -X X509_user_identity=...; ldapwhoami confirms the new identity before S4U2proxy delegation abuse to LDAP as admin.
Output Format
## FreeIPA Finding
**Component**: FreeIPA (LDAP 389/636, Kerberos 88) - realm DOMAIN.LOCAL
**Severity**: Critical
**Finding**: Anonymous LDAP enumeration + reusable host keytab enables path to domain compromise
**Evidence**:
- `ldapsearch -x` returned all users/hosts unauthenticated
- `kinit -k -t /etc/krb5.keytab host/web01@DOMAIN.LOCAL` -> valid TGT (klist)
- `ipa hbacrule-show allow_all --all` + `ipa sudorule-show admins_sudo --all` -> CanSSH+CanSUDO to dc1
- sudo on dc1 allowed read of /var/lib/dirsrv/.../id2entry.db
**Impact**: An attacker on any joined host can enumerate the directory anonymously and chain HBAC/sudo rules to reach a domain controller, yielding the full identity database and effective domain compromise.
**Recommendation**:
1. Disable anonymous LDAP binds (restrict `nsslapd-allow-anonymous-access`).
2. Scope HBAC and sudo rules to least privilege; avoid `allow_all` and `ipaSudoOpt=!authenticate` on DCs.
3. Protect keytabs/CCACHE (tight perms, rotation) and monitor for offline ticket/keytab reuse.
4. Enforce strong hashing and MFA; restrict who holds the `admin` role and CA/cert-request privileges.
