Lee Christensen
5.8 KiB
Authentication Data
Date type: authentication_data
Overview
Data that may be used to authenticate to a resource. The resource does not need to be accessible over a network and a local resource may be specified using the file:// scheme in the URI parameter. The type data may be anything that may be used to authenticate such as a password, certificate, JWT, SAML token, TGT, NTLM hash, private key, etc. The authentication data does not need to be additionally encoded because all ODR string parameters already support hex encoding values.
| Parameters | Format | Description |
|---|---|---|
| data | string/UUID | Case sensitive data or a Nemesis UUID reference (if > 1024 bytes and is_file is True) |
| type | string | Type of the auth data (defined below) |
| is_file | bool | True if data is a reference to a binary submission |
| uri | string | Location of where the data is valid |
| username | string | Simple or FQDN username if applicable |
| notes | string | Any additional notes/context |
| originating_object_id | UUID | The Nemesis UUID reference of the file the data was extracted from (if appliable) |
Supported Type values
Type values are not case-sensitive.
Any value can be submitted for the "type", however only the following values are formally supported:
| Name | Description |
|---|---|
| unknown | unknown auth data type |
| password | plaintext/decrypted password |
| dpapi_masterkey | GUID:SHA1 of a user/machine DPAPI master key |
| dpapi_system | DPAPI_SYSTEM LSA secret |
| ntlm_hash | Same as the RC4_HMAC_MD5 Kerberos key |
| aes_128_key | Kerberos - AES128_HMAC_SHA1 key |
| aes_256_key | Kerberos - AES256_HMAC_SHA1 key |
| kerberos_ticket_kiribi | Kerberos .kirbi cred file - TGT or service ticket |
| kerberos_ticket_ccache | Kerberos .ccache cred file - TGT or service ticket |
| adcs_certificate | Kerberos - AD CS certificate capable of authentication |
| saml_token | Web - Security Assertion Markup Language (SAML) token |
| json_web_token | Web - JSON Web Token (JWT) |
| api_key | Web - key for a web API |
| private_key | Misc - private key |
| misc | Misc auth data type |
| hash_ms_dcc | Microsoft Cache/Domain Cached Credentials |
| hash_krb_tgs_rep_23 | Kerberos 5, etype 23, TGS-REP (kerberoasting) |
| hash_krb_as_rep_23 | Kerberos 5, etype 23, AS-REP (asrep-roasting) |
| hash_krb_tgs_rep_17 | Kerberos 5, etype 17, TGS-REP (AES128-CTS-HMAC-SHA1-96) (AES128 kerberoasting) |
| hash_krb_tgs_rep_18 | Kerberos 5, etype 18, TGS-REP (AES256-CTS-HMAC-SHA1-96) (AES256 kerberoasting) |
| hash_krb_as_req_23 | Kerberos 5, etype 23, AS-REQ Pre-Auth |
| hash_ms_office | Extracted from MS Office documents with office2john |
| hash_zip | Extracted from MS Office documents with zip2john |
| hash_pdf | Extracted from pdf documents with pdf2john |
| hash_apple_keychain | Apple Keychain |
| hash_crypt | md5crypt/shacrypt/etc. from linux shadow files |
| hash_mssql | MSSQL hash formats |
| hash_cisco_ios | Cisco-IOS (PBKDF2-SHA256/scrypt/etc.) |
The hash_<SUB_TYPE> type values are meant for cracking, while other values are "plaintext".
Protobuf Definition
AuthenticationDataIngestionMessage and AuthenticationDataIngestion in nemesis.proto
Examples
{
"data": [
...
{
"uri": "ftp://192.168.10.10:8080",
"username": "user",
"type": "password",
"is_file": false,
"data": "pass1!",
"notes": "found while working",
},
...
]
"metadata": {
"agent_id": "339429212",
"agent_type": "beacon",
"automated": 1,
"data_type": "authentication_data",
"expiration": "2023-08-01T22:51:35",
"source": "DC",
"project": "ASSESS-X",
"timestamp": "2022-08-01T22:51:35"
}
}