Attacking FreeIPA, the open-source Active-Directory alternative for Unix environments, during authorized red-team operations - covering anonymous and authenticated LDAP/ipa enumeration, Kerberos CCACHE/keytab credential theft and reuse, HBAC and sudo rule abuse, hash extraction and cracking, IPAHound graphing, and PKINIT/S4U2proxy host-account takeover.
Attacking FreeIPA, the open-source Active-Directory alternative for Unix environments, during authorized red-team operations - covering anonymous and authenticated LDAP/ipa enumeration, Kerberos CCACHE/keytab credential theft and reuse, HBAC and sudo rule abuse, hash extraction and cracking, IPAHound graphing, and PKINIT/S4U2proxy host-account takeover.
domain
cybersecurity
subdomain
red-teaming
tags
["red-teaming","freeipa","kerberos"]
version
1.0
author
xalgorix
license
Apache-2.0
Pentesting FreeIPA
When to Use
You find Unix/Linux hosts integrated with a central identity provider, a FreeIPA web UI on 443, or /etc/krb5.conf and /etc/ipa/default.conf on a foothold.
LDAP (389/636) and Kerberos (88) services answer on a server and clients have sssd configured.
You compromised a domain-joined Unix host and want to enumerate users/hosts/groups, harvest Kerberos tickets, and abuse HBAC/sudo rules for lateral movement.
You hold a standard user, a host keytab, or a service account and need a graph-driven path to domain compromise.
Critical: Techniques Most Often Missed
Anonymous LDAP bind — by default FreeIPA's LDAP allows anonymous binds, exposing a large amount of data unauthenticated.
ldapsearch -x # anonymous bind, dumps enumerable data unauthenticated
How to CONFIRM: ldapsearch -x -b "dc=domain,dc=local" returns user/host entries without credentials.
Stealing and reusing CCACHE tickets from /tmp — CCACHE files live in /tmp with 600 perms and let you authenticate without the plaintext password.
klist # parse the current ticketexport KRB5CCNAME=/tmp/krb5cc_1000 # reuse a stolen ccache
klist # confirm the imported TGT
How to CONFIRM: after exporting KRB5CCNAME, klist shows a valid krbtgt/... ticket and ipa user-find works without kinit.
Keytab reuse for non-interactive TGTs — /etc/krb5.keytab (hosts) and service keytabs yield TGTs without any password via kinit -k.
kinit -k -t /etc/krb5.keytab 'host/srv.domain.local@DOMAIN.LOCAL'
klist -k /etc/krb5.keytab # enumerate principals/keys in a keytab
How to CONFIRM: succeeds and shows the host/service TGT; reuse it against LDAP with .
kinit -kt
klist
ldapwhoami
admin == Domain Admin; root on the IPA server owns the hashes — the FreeIPA admin role equals AD domain admins, and root on the server can dump hashes with dbscan (userPassword/ipaNTHash base64 attributes).
How to CONFIRM: ipa user-show admin --all and, on the server as root, dbscan extraction of userPassword/ipaNTHash.
HBAC + sudo rule chaining to a DC — CanSSH (HBAC allows sshd) plus CanSUDO (HBAC + matching sudo rule, especially ipaSudoOpt=!authenticate) to a domain controller can let you steal id2entry.db = effectively full domain compromise.
How to CONFIRM: ipa hbacrule-show <rule> --all and ipa sudorule-show <rule> --all reveal a path; test ssh then sudo -l on the target host.
BloodHound-style FreeIPA attack graphing and path discovery.
LinikatzV2 / linikatz
Harvest Kerberos/secret material from Unix hosts.
ipa-getkeytab / ldapmodify
Reset service keys; write certs for PKINIT takeover.
Common Scenarios
Scenario 1: Anonymous LDAP exposes the directory
ldapsearch -x against the FreeIPA server returns users, groups, and hosts without credentials, giving a full target list and revealing service accounts to spray.
Scenario 2: Host keytab to lateral movement
A compromised client's /etc/krb5.keytab is reused with kinit -k -t /etc/krb5.keytab host/srv@DOMAIN.LOCAL. Authenticated ldapsearch -Y gssapi and ipa hbacrule-find map a CanSSH+CanSUDO path to a domain controller; SSHing and sudo there allows copying id2entry.db.
Scenario 3: Service account PKINIT takeover
Holding a computer account that owns its service principals, the operator issues a cert with ipa cert-request, writes userCertificate;binary to the service object via ldapmodify, and runs kinit -X X509_user_identity=...; ldapwhoami confirms the new identity before S4U2proxy delegation abuse to LDAP as admin.
Output Format
## FreeIPA Finding
**Component**: FreeIPA (LDAP 389/636, Kerberos 88) - realm DOMAIN.LOCAL
**Severity**: Critical
**Finding**: Anonymous LDAP enumeration + reusable host keytab enables path to domain compromise
**Evidence**:
- `ldapsearch -x` returned all users/hosts unauthenticated
- `kinit -k -t /etc/krb5.keytab host/web01@DOMAIN.LOCAL` -> valid TGT (klist)
- `ipa hbacrule-show allow_all --all` + `ipa sudorule-show admins_sudo --all` -> CanSSH+CanSUDO to dc1
- sudo on dc1 allowed read of /var/lib/dirsrv/.../id2entry.db
**Impact**: An attacker on any joined host can enumerate the directory anonymously and chain HBAC/sudo rules to reach a domain controller, yielding the full identity database and effective domain compromise.
**Recommendation**:
1. Disable anonymous LDAP binds (restrict `nsslapd-allow-anonymous-access`).
2. Scope HBAC and sudo rules to least privilege; avoid `allow_all` and `ipaSudoOpt=!authenticate` on DCs.
3. Protect keytabs/CCACHE (tight perms, rotation) and monitor for offline ticket/keytab reuse.
4. Enforce strong hashing and MFA; restrict who holds the `admin` role and CA/cert-request privileges.
