Skip to main content

Kerberoasting​

Kerberoasting is a common AD Attack to obtain AD Tickets that helps with Persistence. In order for this Attack to work, an adversary must have access to Service Principal Name (SPN) Accounts such as IIS User, MSSQL, etc. The Kerberoasting Attack involves Requesting a Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS).

First, we need to find an SPN Account(s), and then we can send a Request to get a TGS Ticket. We can perform the Kerberoasting Attack from Our Machine using the Impacket GetUserSPNs.py Python Script.

Once we find the SPN User, we can send a single request to get a TGS Ticket.

:: Find the User
GetUserSPNs.py -dc-ip <IP> <Domain>

:: Request the TGS Ticket
GetUserSPNs.py -dc-ip <IP> <Domain> -request-user <Username>


We can Crack the obtained TGS Ticket using HashCat.

hashcat -a 0 -m 13100 <HASH> <Wordlist>

AS-REP Roasting​

Requirements: List of Domain Accounts

AS-REP Roasting is the Technique that Enables the Attacker to retrieve Password Hashes for AD Users whose Account options have been set to Do not Require Kerberos Pre-Authentication.

This option relies on the old Kerberos Authentication Protocol, which allows Authentication without a Password. Once we obtain the Hashes, we can try to Crack it Offline. Before performing the AS-REP Roasting, we need a List of Domain Accounts that should be gathered during Enumeration.

GetNPUsers.py -format -dc-ip <IP> <Domain> -usersfile <File with Domain Account Names>