Identity Crisis: Cerberus, Circe, and Kerberos

What a three-headed dog, a sorceress, and a stolen coin can teach us about Kerberos and Pass the Ticket attacks.

I was learning about Kerberos and got curious about the name, so I looked up the etymology. Two minutes later I somehow found myself daydreaming about Cerberus, Circe, LSASS, and an attacker sneaking through the underworld.

This is the part where you really have to walk with me, and maybe listen to a few songs from EPIC: The Musical.

Three heads, three parties

Kerberos comes from Cerberus, the three-headed dog guarding the gates of the underworld. Once I saw that, I started wondering if the three heads actually represented something. The more I thought about it, the more it fit.

Kerberos authentication involves three parties working together:

• The client asking for access
• The Key Distribution Center (KDC), the authority that verifies identity and issues tickets
• The service deciding whether a ticket lets someone in

Instead of repeating a password at every gate, the system verifies your identity once and issues a ticket. After that, the rest of the environment trusts the ticket because it trusts the authority that issued it.

That trust is the whole point. It’s also the weakness.

The castle and the first coin

In my drawing, the castle is the KDC. When a user logs in, the castle verifies who they are and hands them the first coin: the Ticket Granting Ticket, or TGT.

• AS-REQ: the user asks to authenticate
• AS-REP: the castle hands over the TGT

Circe holds this coin. She belongs in that world, and she represents an identity that has already been authenticated.

Circe’s palace is LSASS

Circe’s palace is basically identity chaos. Sailors walk in as men and walk out as pigs. Inside her domain, the rules of identity can be completely rewritten.

That reminded me of LSASS. LSASS is the Windows process that holds authentication material after login: Kerberos tickets, credential material, and tokens proving the system has already verified who you are. It’s where the system keeps the things that let identities move through the environment.

Odysseus never gets a coin from the castle. He doesn’t need one. He takes Circe’s.

That is the heart of a Pass the Ticket attack. An attacker who has gained access to a machine (usually with admin rights) pulls Kerberos tickets out of LSASS memory and walks away holding proof of identity that the castle legitimately issued.

And notice that Circe still has her coin. Stealing a ticket from memory doesn’t take it away. It copies it. The real user keeps working normally and has no idea anything is missing.

Trading coins at the castle

With his copy of Circe’s coin, Odysseus returns to the castle and trades it for a second coin meant for one specific gate: the service ticket.

• TGS-REQ: present the TGT and ask for a service ticket
• TGS-REP: receive the service ticket

The castle doesn’t ask for a password again. It sees a valid TGT that it issued itself, and that’s enough.

Cerberus checks the coin, not the traveler

At the gate stands Cerberus. Only the dead and the immortals belong in the underworld, but Cerberus doesn’t check whether a traveler is alive. He checks three things:

1. Was this coin issued by the castle?
2. Is it still valid?
3. Is it meant for this gate?

• AP-REQ: the traveler presents the service ticket, and the service accepts it

Odysseus passes all three checks with a coin that was never his.

A ticket for one destination

Inside the underworld, the spirits of the dead call out to Odysseus, but he can’t stop to speak with them. The only one he has permission to speak with is Tiresias, the prophet.

Tiresias is the service the ticket was issued for. The coin doesn’t grant access to everything. It grants access to one destination.

Kerberos works the same way: systems trust the ticket and the scope attached to it.

This is lateral movement in its purest form. The attacker didn’t break anything. They took trust that was issued somewhere else and carried it into a place they could never have reached on their own.

How defenders catch it

Cerberus might not notice, but the logs can.

When a user logs in normally, the domain controller records a 4768 (TGT requested) from their machine, followed by 4769 events (service ticket requested) from that same machine. With Pass the Ticket, the 4769s start showing up from a different host or IP, for a user who never requested a TGT there. That mismatch is one of the clearest signals.

Time is on the defender’s side too. By default a TGT is only good for about 10 hours, so a stolen coin eventually expires. That’s why attackers tend to move fast once they have one.

(For more on what lives in the 4700s, check out my Windows Event IDs sketch.)

Who really won?

In the story, Odysseus does reach Tiresias and receives the prophecy he came for. But the prophecy is vague, symbolic, and heavily obfuscated. He reached the source of the information, but its meaning is still protected.

So now when I think about Kerberos, I picture Cerberus at the gate watching travelers pass through. Most of them belong there. But every once in a while, someone walks past carrying something they should never have had.

Which leaves me wondering: if an attacker reaches the data, but it stays obfuscated enough that they can’t make sense of it, who really won?