Kerberoasting
Basic Information
Kerberoasting focuses on the acquisition of TGS tickets, specifically those related to services operating under user accounts in Active Directory (AD), excluding computer accounts. The encryption of these tickets utilizes keys that originate from user passwords, allowing for the possibility of offline credential cracking. The use of a user account as a service is indicated by a non-empty "ServicePrincipalName" property.
For executing Kerberoasting, a domain account capable of requesting TGS tickets is essential; however, this process does not demand special privileges, making it accessible to anyone with valid domain credentials.
Kerberoasting targets TGS tickets from user-account services within AD.
Tickets encrypted with keys from user passwords can be cracked offline.
A service is identified by a ServicePrincipalName that is not null
No special privileges are needed, just valid domain credentials
How the Attack Works
In Kerberos authentication, when the user wants to access a resource hosted by a Service Principal Name (SPN), the client requests a service ticket that is generated by the domain controller. The service ticket is then decrypted and validated by the application server, since it is encrypted via the hash of the SPN.
When requesting the service ticket from the domain controller, no checks are performed to confirm whether the user has any permissions to access the service hosted by the SPN. These checks are performed as a second step only when connecting to the service itself. This means that if you know the SPN we want to target, we can request a service ticket for it from the domain controller.
The service ticket is encrypted using the SPN's password hash. If we are able to request the ticket and decrypt it using brute force or guessing, we can use this information to crack the cleartext password of the service account.
The Attack
Kerberoasting with Rubeus
Rubeus can be used for a Kerberoasting attack by using the kerberoast command. We can also specify an outfile to write found hashes to:
Then crack found hashes using hashcat
Kerberoasting with Impacket-GetUserSPNs
Use the IP of the domain controller for the argument -dc-ip and we will have to include domain user credentials to obtain the TGS-REP hash.
If impacket-GetUserSPNs throws the error "KRB_AP_ERR_SKEW(Clock skew too great)," we need to synchronize the time of the Kali machine with the domain controller. Can use ntpdate or rdate to do so.
Then crack with hashcat.
Linux
Cracking
Persistence
If you have enough permissions over a user, you can make it kerberoastable:
Targeted Kerberoasting
If you have GenericWrite or GenericAll permissions on another AD user account, you can set the SPN for the user, kerberoast the account, and crack the password hash. You should delete the SPN once the hash has been obtained to avoid adding any vulnerabilities to a client's infrastructure.
Last updated