Kerberoast
ASREPRoast to Kerberoast
As soon as you have an ASREProastable account, you can request service tickets for any account that has a SPN (Service Principal Name) set
NXC
Impacket
List SPN Account
Request all TGS
Request a single TGS
Crack
Hashes
Windows
User accounts used as Service accounts
CMD - Built In setspn
AD Module
PowerView
TGS for one user using .NET classes
All tickets
Mimikatz
MimikatzIf we do not specify the base64 /out:true command, Mimikatz will extract the tickets and write them to .kirbi files
Remove new lines and white space
Place to kirbi file
Crack
This will create a file called crack_file.
You can also crack the .kirbi ticket directly
Check if the ticket has been granted
Export all tickets using Mimikatz
Crack the Service account password
PowerView
Target specific user
Export to CSV file
Rubeus
List Kerberoast stats
Request a TGS
Avoid detection - Kerberoastable account that only support RC4_HMAC
All possible accounts
/tgtdeleg flag to specify that we want only RC4 encryption when requesting a new service ticket
This does not work against a Windows Server 2019 Domain Controller, regardless of the domain functional level
Empire - Invoke-Kerberoast
SharpADWS
Roast In The Middle
Remediation
gMSA:
gMSA
The following security controls should be implemented to mitigate Kerberoasting:
Minimise the number of user objects configured with SPNs. This reduces the attack surface for malicious actors to execute Kerberoasting.
Create user objects with SPNs as group Managed Service Accounts (gMSAs). gMSAs have automatic password rotation, a 120-character password and simplified SPN management. These security features protect the password from being cracked, reducing the likelihood of successful Kerberoasting. However, if creating user objects with SPNs as gMSAs is not feasible, for example, it is a non-Windows based system hosting the service, or the application does not fully support gMSAs, such as Microsoft’s System Center Configuration Manager, set a minimum 30-character password that is unique, unpredictable and managed.
Assign user objects with SPNs the minimum privileges necessary to perform their functions and make sure they are not members of highly privileged security groups, such as the Domain Admins security group. If malicious actors successfully execute Kerberoasting and crack the TGS ticket to reveal the cleartext password, minimising the privileges assigned to the user object will reduce the impact and limit the access gained by the malicious actor.
Resources
Interesting Book
Interesting BooksPentesting Active Directory and Windows-based Infrastructure Enhance your skill set to pentest against real-world Microsoft infrastructure with hands-on exercises and by following attack/detect guidelines with OpSec considerations
Infrastructure Attack Strategies for Ethical Hacking Encompassing both external and internal enumeration techniques, the book delves into attacking routers and services, establishing footholds, privilege escalation, lateral movement, and exploiting databases and Active Directory.
RTFM: Red Team Field Manual v2 A quick reference when there is no time to scour the Internet for that perfect command
Red Team Development and Operations: A practical guide The authors have moved beyond SANS training and use this book to detail red team operations in a practical guide.
Cybersecurity Attacks – Red Team Strategies A practical guide to building a penetration testing program having homefield advantage
Support this Gitbook
I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.
Last updated