Kerberoasting
Last updated
Last updated
This attack targets Service Principal Names (SPNs) accounts.
Purpose of Service Principal Names (SPN) in Active Directory
SPNs are unique identifiers that Kerberos uses to map a service instance to a service account in whose context the service is running
Domain accounts are often used to run services to overcome the network authentication limitations of built-in accounts such as NT AUTHORITY\LOCAL SERVICE.
Depending on your position in a network, this attack can be performed in multiple ways:
From a non-domain joined Linux host using valid domain user credentials.
From a domain-joined Linux host as root after retrieving the keytab file.
From a domain-joined Windows host authenticated as a domain user.
From a domain-joined Windows host with a shell in the context of a domain account.
As SYSTEM on a domain-joined Windows host.
From a non-domain joined Windows host using /netonly.
crack with Hashcat
password is database!
Testing Authentication against a Domain Controller
The -AssemblyName parameter allows us to specify an assembly that contains types that we are interested in using
/tgtdeleg flag, the tool requested an RC4 ticket even though the supported encryption types are listed as AES 128/256
https://adsecurity.org/?p=3458
The cmdlet is used to add a .NET framework class to our PowerShell session, which can then be instantiated like any .NET framework object
is a namespace that contains different classes for building security token services
We'll then use the cmdlet to create an instance of a .NET Framework object
We'll use the namespace with the class to create a security token and pass the SPN name to the class to request a Kerberos TGS ticket for the target account in our current logon session
