# Freeipa Pentesting > FreeIPA penetration testing and enumeration. Use this skill whenever the user mentions FreeIPA, Kerberos on Unix, LDAP enumeration, IPA domain attacks, or any Active Directory-like infrastructure on Linux/Unix systems. This skill covers authentication, enumeration, hash extraction, and privilege escalation techniques for FreeIPA environments. - Skill: `abelrguezr/freeipa-pentesting` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add abelrguezr/freeipa-pentesting` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/freeipa-pentesting/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/freeipa-pentesting --- # FreeIPA Pentesting FreeIPA is an open-source alternative to Microsoft Windows Active Directory for Unix environments. It combines LDAP directory with MIT Kerberos KDC for domain management similar to Active Directory. ## When to Use This Skill Use this skill when: - You need to enumerate or attack a FreeIPA domain - You're working with Kerberos authentication on Linux/Unix - You need to extract or crack FreeIPA password hashes - You're investigating HBAC rules, sudo rules, or role-based access control in FreeIPA - You're doing privilege escalation in a FreeIPA environment ## Quick Reference ### Key Files - `/etc/krb5.conf` - Kerberos client configuration - `/etc/ipa/default.conf` - IPA client/server defaults - `/etc/krb5.keytab` - Kerberos keytab for authentication ### Key Binaries - `ipa` - FreeIPA management tool - `kinit`, `klist`, `kdestroy` - Kerberos ticket management - `kpasswd`, `ksu`, `kswitch`, `kvno` - Additional Kerberos utilities ### Environment Variables - `KRB5CCNAME` - Points to CCACHE ticket file - `KRB5_KTNAME` - Points to keytab file - `KRB5_CONFIG` - Custom krb5.conf location ## Authentication ### CCACHE Tickets CCACHE files store Kerberos credentials in binary format, typically in `/tmp` with 600 permissions. ```bash # Parse a CCACHE ticket klist # Re-use a CCACHE ticket export KRB5CCNAME=/path/to/ticket.ccache ``` ### Unix Keyring Tickets can also be stored in the Linux keyring with various scopes: - `KEYRING:name` - `KEYRING:process:name` - `KEYRING:thread:name` - `KEYRING:session:name` - `KEYRING:persistent:uidnumber` Use **Tickey** to extract tickets from the keyring. ### Keytab Files Keytab files contain Kerberos principals and encrypted keys, allowing TGT acquisition without passwords. ```bash # Parse keytab klist -k /etc/krb5.keytab # Use keytab for authentication kinit -kt /etc/krb5.keytab principal@DOMAIN ``` ## Enumeration ### Anonymous LDAP Enumeration FreeIPA often allows anonymous binds, exposing significant data without authentication. ```bash # Enumerate all available data ldapsearch -x ``` ### Authenticated Enumeration With valid Kerberos tickets, you can query specific objects. ```bash # Get all users ldapsearch -Y gssapi -b "cn=users,cn=compat,dc=domain,dc=local" # Get user groups ldapsearch -Y gssapi -b "cn=groups,cn=accounts,dc=domain,dc=local" # Get all hosts ldapsearch -Y gssapi -b "cn=computers,cn=accounts,dc=domain,dc=local" # Get host groups ldapsearch -Y gssapi -b "cn=hostgroups,cn=accounts,dc=domain,dc=local" ``` ### Using IPA Binaries From a domain-joined machine, use the `ipa` command for enumeration. ```bash ipa user-find ipa usergroup-find ipa host-find ipa host-group-find # Show detailed info ipa user-show --all ipa usergroup-show --all ipa host-show --all ipa hostgroup-show --all ``` > **Note:** The `admin` user in FreeIPA is equivalent to Domain Admins in Active Directory. ### Hash Extraction The root user on the IPA server can access password hashes stored in base64 format within the `userPassword` attribute. - **SSHA512** - Old FreeIPA versions - **PBKDF2_SHA256** - New FreeIPA versions - **ipaNTHash** - AD integration (NT hash in base64) ```bash # Extract hashes using dbscan (requires root on IPA server) dbscan -c /var/lib/ipa/... ``` #### Hash Cracking Workflow 1. **Decode base64** from the attribute 2. **For NT hash (AD integration):** Re-encode as ASCII hex, then use John/hashcat 3. **For SSHA512:** Extract the hash portion, use John/hashcat 4. **For PBKDF2_SHA256:** Use first 256 bits (32 bytes) with John/hashcat ### HBAC Rules Host-Based Access Control rules define what permissions users and hosts have over domain resources. ```bash # Enumerate HBAC rules ldapsearch -Y gssapi -b "cn=hbac,dc=domain,dc=local" ipa hbacrule-find ipa hbacrule-show --all ``` ### Sudo Rules Sudo rules control which commands can be executed with elevated privileges across the domain. ```bash # Enumerate sudo rules ldapsearch -Y gssapi -b "cn=sudorules,cn=sudo,dc=domain,dc=local" ipa sudorule-find ipa sudorule-show --all ``` ### Role-Based Access Control Roles bundle together privileges and permissions that can be assigned to users, groups, hosts, and services. ```bash # Enumerate roles, privileges, and permissions ipa role-find ipa role-show --all ipa privilege-find ipa privilege-show --all ipa permission-find ipa permission-show --all ``` ## Tools ### Linikatz - [LinikatzV2](https://github.com/Orange-Cyberdefense/LinikatzV2) - [Linikatz](https://github.com/CiscoCXSecurity/linikatz) ## References - [SpecterOps FreeIPA Attack Series Part I - Authentication](https://posts.specterops.io/attacking-freeipa-part-i-authentication-77e73d837d6a) - [SpecterOps FreeIPA Attack Series Part II - Enumeration](https://posts.specterops.io/attacking-freeipa-part-ii-enumeration-ad27224371e1) - [SpecterOps FreeIPA Attack Series Part III - Finding a Path](https://posts.specterops.io/attacking-freeipa-part-iii-finding-a-path-677405b5b95e) - [CVE-2020-10747 - Root User Creation](https://posts.specterops.io/attacking-freeipa-part-iv-cve-2020-10747-7c373a1bf66b) - [FreeIPA Pentesting Video](https://www.youtube.com/watch?v=9dOu-7BTwPQ)