Kerberos Attack

January 2020

Introduction

Kerberos is an authentication protocol that used to identify a user with provided the secret code, but it does not provide the validation on the resources access. Kerberos is used in Active Directory.

The following are the attack strategy according to the privileges you have. Thus, perform the first attacks only connectivity with the DC (Domain Controller) is required, which is the KDC (Key Distribution Center) for the AD (Active Directory) network. Whereas, the last attack requires a user being a Domain Administrator or having similar privileges.

  • Kerberos brute-force

  • ASREPRoast

  • Kerberoasting

  • Pass the key

  • Pass the ticket

  • Silver ticket

  • Golden ticket

Kerberos Attack Methods

Tools

Bruteforcing

With kerbrute.py:

ASREPRoast

With Impacket example GetNPUsers.py, Lab Example: https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/blackfield#enumeration-through-rpc

Kerberoasting

With Impacket example GetUserSPNs.py:

With Powershell:

Cracking with dictionary of passwords:

Pass The Hash (PtH)

By using Impacket examples

Lab Example: OSCP Lab SV-DC01, SVCClient17x (10.11.1.20 - 10.11.1.24)

With Rubeus and PsExec:

Pass The Ticket (PtT)

With Mimikatz:

With Rubeus in Powershell:

To convert tickets between Linux/Windows format with ticket_converter.py:

Using ticket in Windows

Inject ticket with Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Silver ticket

With Impacket examples:

With Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Golden ticket

With Impacket examples:

With Mimikatz:

Inject ticket with Rubeus:

Execute a cmd in the remote machine with PsExec:

Reference Link- How does Kerberos work?

LogoKerberos (I): How does Kerberos work? - TheoryTarlogic Security

PreviousCredential Dumping: DCSyncNextRDP

Last updated

Was this helpful?